Moodle release 3.10.3

weekly release 3.10.2+
Merge branch 'MDL-71182-310-2' of git://github.com/lameze/moodle into MOODLE_310_STABLE
2021-03-24 20:13:09 +01:00 · 2021-03-24 14:21:00 +00:00 · 2021-03-24 10:50:23 +01:00 · 2021-03-24 17:34:31 +08:00 · 2021-03-24 09:22:04 +08:00 · 2021-03-23 23:01:31 +00:00
1135 changed files with 13959 additions and 7635 deletions
@@ -0,0 +1,71 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Template configuraton file for github actions CI/CD.
+ *
+ * @package    core
+ * @copyright  2020 onwards Eloy Lafuente (stronk7) {@link https://stronk7.com}
+ * @license    https://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+// This cannot be used out from a github actions workflow, so just exit.
+getenv('GITHUB_WORKFLOW') || die; // phpcs:ignore moodle.Files.MoodleInternal.MoodleInternalGlobalState
+
+unset($CFG);
+global $CFG;
+$CFG = new stdClass();
+
+$CFG->dbtype    = getenv('dbtype');
+$CFG->dblibrary = 'native';
+$CFG->dbhost    = '127.0.0.1';
+$CFG->dbname    = 'test';
+$CFG->dbuser    = 'test';
+$CFG->dbpass    = 'test';
+$CFG->prefix    = 'm_';
+$CFG->dboptions = ['dbcollation' => 'utf8mb4_bin'];
+
+$host = 'localhost';
+$CFG->wwwroot   = "http://{$host}";
+$CFG->dataroot  = realpath(dirname(__DIR__)) . '/moodledata';
+$CFG->admin     = 'admin';
+$CFG->directorypermissions = 0777;
+
+// Debug options - possible to be controlled by flag in future.
+$CFG->debug = (E_ALL | E_STRICT); // DEBUG_DEVELOPER.
+$CFG->debugdisplay = 1;
+$CFG->debugstringids = 1; // Add strings=1 to url to get string ids.
+$CFG->perfdebug = 15;
+$CFG->debugpageinfo = 1;
+$CFG->allowthemechangeonurl = 1;
+$CFG->passwordpolicy = 0;
+$CFG->cronclionly = 0;
+$CFG->pathtophp = getenv('pathtophp');
+
+$CFG->phpunit_dataroot  = realpath(dirname(__DIR__)) . '/phpunitdata';
+$CFG->phpunit_prefix = 't_';
+
+define('TEST_EXTERNAL_FILES_HTTP_URL', 'http://localhost:8080');
+define('TEST_EXTERNAL_FILES_HTTPS_URL', 'http://localhost:8080');
+
+define('TEST_SESSION_REDIS_HOST', 'localhost');
+define('TEST_CACHESTORE_REDIS_TESTSERVERS', 'localhost');
+
+// TODO: add others (solr, mongodb, memcached, ldap...).
+
+// Too much for now: define('PHPUNIT_LONGTEST', true); // Only leaves a few tests out and they are run later by CI.
+
+require_once(__DIR__ . '/lib/setup.php');
@@ -0,0 +1,103 @@
+name: Core
+
+on: [push]
+
+env:
+  php: 7.4
+
+jobs:
+  Grunt:
+    runs-on: ubuntu-18.04
+
+    steps:
+      - name: Checking out code
+        uses: actions/checkout@v2
+
+      - name: Configuring node & npm
+        shell: bash -l {0}
+        run: nvm install
+
+      - name: Installing node stuff
+        run: npm install
+
+      - name: Running grunt
+        run: npx grunt
+
+      - name: Looking for uncommitted changes
+        # Add all files to the git index and then run diff --cached to see all changes.
+        # This ensures that we get the status of all files, including new files.
+        # We ignore npm-shrinkwrap.json to make the tasks immune to npm changes.
+        run: |
+          git add .
+          git reset -- npm-shrinkwrap.json
+          git diff --cached --exit-code
+
+  PHPUnit:
+    runs-on: ${{ matrix.os }}
+    services:
+      exttests:
+        image: moodlehq/moodle-exttests
+        ports:
+          - 8080:80
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-18.04
+            php: 7.2
+            db: mysqli
+          - os: ubuntu-18.04
+            php: 7.4
+            db: pgsql
+
+    steps:
+      - name: Setting up DB mysql
+        if: ${{ matrix.db == 'mysqli' }}
+        uses: johanmeiring/mysql-action@tmpfs-patch
+        with:
+          collation server: utf8mb4_bin
+          mysql version: 5.7
+          mysql database: test
+          mysql user: test
+          mysql password: test
+          use tmpfs: true
+
+      - name: Setting up DB pgsql
+        if: ${{ matrix.db == 'pgsql' }}
+        uses: m4nu56/postgresql-action@v1
+        with:
+          postgresql version: 9.6
+          postgresql db: test
+          postgresql user: test
+          postgresql password: test
+
+      - name: Configuring git vars
+        uses: rlespinasse/github-slug-action@v3.x
+
+      - name: Setting up PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+
+      - name: Checking out code from ${{ env.GITHUB_REF_SLUG }}
+        uses: actions/checkout@v2
+
+      - name: Setting up PHPUnit
+        env:
+          dbtype: ${{ matrix.db }}
+        run: |
+          echo "pathtophp=$(which php)" >> $GITHUB_ENV # Inject installed pathtophp to env. The template config needs it.
+          cp .github/workflows/config-template.php config.php
+          mkdir ../moodledata
+          sudo locale-gen en_AU.UTF-8
+          php admin/tool/phpunit/cli/init.php --no-composer-self-update
+
+      - name: Running PHPUnit tests
+        env:
+          dbtype: ${{ matrix.db }}
+        run: vendor/bin/phpunit -v
@@ -16,31 +16,9 @@ services:
    - mysql
    - docker

-php:
-    # We only run the highest and lowest supported versions to reduce the load on travis-ci.org.
-    - 7.4
-    - 7.2
-
 addons:
  postgresql: "9.6"

-env:
-    # Although we want to run these jobs and see failures as quickly as possible, we also want to get the slowest job to
-    # start first so that the total run time is not too high.
-    #
-    # We only run MySQL on PHP 7.2, so run that first.
-    # CI Tests should be second-highest in priority as these only take <= 60 seconds to run under normal circumstances.
-    # Postgres is significantly is pretty reasonable in its run-time.
-
-    # Run CI Tests without running PHPUnit.
-    - DB=none     TASK=CITEST
-
-    # Run unit tests on Postgres
-    - DB=pgsql    TASK=PHPUNIT
-
-    # Perform an upgrade test too.
-    - DB=pgsql    TASK=UPGRADE
-
 jobs:
    # Enable fast finish.
    # This will fail the build if a single job fails (except those in allow_failures).
@@ -48,12 +26,35 @@ jobs:
    fast_finish: true

    include:
-          # Run mysql only on highest - it's just too slow
-        - php: 7.4
+        # First all the lowest php ones (7.2)
+        - php: 7.2
+          env: DB=none     TASK=CITEST
+        - php: 7.2
+          env: DB=none     TASK=GRUNT    NVM_VERSION='lts/carbon'
+
+        - if: env(MOODLE_DATABASE) = "pgsql" OR env(MOODLE_DATABASE) = "all" OR env(MOODLE_DATABASE) IS NOT present
+          php: 7.2
+          env: DB=pgsql    TASK=PHPUNIT
+
+        - if: env(MOODLE_DATABASE) = "mysqli" OR env(MOODLE_DATABASE) = "all"
+          php: 7.2
+          env: DB=mysqli   TASK=PHPUNIT
+
+        # Then, conditionally, all the highest php ones (7.4)
+        - if: env(MOODLE_PHP) = "all"
+          php: 7.4
+          env: DB=none     TASK=CITEST
+        - if: env(MOODLE_PHP) = "all"
+          php: 7.4
+          env: DB=none     TASK=GRUNT    NVM_VERSION='lts/carbon'
+
+        - if: env(MOODLE_PHP) = "all" AND (env(MOODLE_DATABASE) = "pgsql" OR env(MOODLE_DATABASE) = "all" OR env(MOODLE_DATABASE) IS NOT present)
+          php: 7.4
+          env: DB=pgsql    TASK=PHPUNIT
+
+        - if: env(MOODLE_PHP) = "all" AND (env(MOODLE_DATABASE) = "mysqli" OR env(MOODLE_DATABASE) = "all")
+          php: 7.4
          env: DB=mysqli   TASK=PHPUNIT
-          # Run grunt/npm install on highest version too ('node' is an alias for the latest node.js version.)
-        - php: 7.4
-          env: DB=none     TASK=GRUNT   NVM_VERSION='lts/carbon'

 cache:
    directories:
@@ -113,7 +114,7 @@ install:
 before_script:
    - phpenv config-rm xdebug.ini
    - >
-      if [ "$TASK" = 'PHPUNIT' -o "$TASK" = 'UPGRADE' ];
+      if [ "$TASK" = 'PHPUNIT' ];
      then
        # Copy generic configuration in place.
        cp config-dist.php config.php ;
@@ -224,32 +225,6 @@ before_script:
        export phpcmd=`which php`;
      fi

-    ########################################################################
-    # Upgrade test
-    ########################################################################
-    - >
-      if [ "$TASK" = 'UPGRADE' ];
-      then
-        # We need the official upstream.
-        git remote add upstream https://github.com/moodle/moodle.git;
-
-        # Checkout 30 STABLE branch (the first version compatible with PHP 7.x)
-        git fetch upstream MOODLE_30_STABLE;
-        git checkout MOODLE_30_STABLE;
-
-        # Perform the upgrade
-        php admin/cli/install_database.php --agree-license --adminpass=Password --adminemail=admin@example.com --fullname="Upgrade test" --shortname=Upgrade;
-
-        # Return to the previous commit
-        git checkout -;
-
-        # Perform the upgrade
-        php admin/cli/upgrade.php --non-interactive --allow-unstable ;
-
-        # The local_ci repository can be used to check upgrade savepoints.
-        git clone https://github.com/moodlehq/moodle-local_ci.git local/ci ;
-      fi
-
 script:
    - >
      if [ "$TASK" = 'PHPUNIT' ];
@@ -275,23 +250,6 @@ script:
        git diff --cached --exit-code ;
      fi

-    ########################################################################
-    # Upgrade test
-    ########################################################################
-    - >
-      if [ "$TASK" = 'UPGRADE' ];
-      then
-        cp local/ci/check_upgrade_savepoints/check_upgrade_savepoints.php ./check_upgrade_savepoints.php
-        result=`php check_upgrade_savepoints.php`;
-        # Check if there are problems
-        count=`echo "$result" | grep -P "ERROR|WARN" | wc -l` ;
-        if (($count > 0));
-        then
-          echo "$result"
-          exit 1 ;
-        fi
-      fi
-
 after_script:
    - >
      if [ "$TASK" = 'PHPUNIT' ];
@@ -2,7 +2,7 @@ MOODLE TRADEMARKS POLICY
 ========================

 The word "Moodle" is trademarked in many countries around the world. The word
-was originally an acronym: Modular Object-Oriented Dynamic Learning
+was originally coined as an acronym: Modular Object-Oriented Dynamic Learning
 Environment. The trademark is owned by Martin Dougiamas, Founder and Director
 of Moodle.

@@ -2815,6 +2815,7 @@
      <VENDOR name="oracle" version="11.2" />
    </DATABASE>
    <PHP version="7.1.0" level="required">
+      <RESTRICT function="restrict_php_version_80" message="unsupportedphpversion80" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -2996,6 +2997,7 @@
      <VENDOR name="oracle" version="11.2" />
    </DATABASE>
    <PHP version="7.2.0" level="required">
+      <RESTRICT function="restrict_php_version_80" message="unsupportedphpversion80" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -3177,6 +3179,7 @@
      <VENDOR name="oracle" version="11.2" />
    </DATABASE>
    <PHP version="7.2.0" level="required">
+      <RESTRICT function="restrict_php_version_80" message="unsupportedphpversion80" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -3344,4 +3347,186 @@
      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
+  <MOODLE version="3.11" requires="3.6">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="10.2.29" />
+      <VENDOR name="mysql" version="5.7" />
+      <VENDOR name="postgres" version="9.6" />
+      <VENDOR name="mssql" version="14.0" />
+      <VENDOR name="oracle" version="11.2" />
+    </DATABASE>
+    <PHP version="7.3.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="mbstringrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+      <PHP_EXTENSION name="sodium" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_sixtyfour_bits" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="sixtyfourbitswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -32,6 +32,7 @@ $result = optional_param('result', null, PARAM_INT);

 $pageurl = new \moodle_url('/admin/tasklogs.php');
 $pageurl->param('filter', $filter);
+$pageurl->param('result', $result);

 $PAGE->set_url($pageurl);
 $PAGE->set_context(context_system::instance());
@@ -46,6 +46,7 @@ $string['stepsdefinitionstype'] = 'Type';
 $string['theninfo'] = 'Then. Checkings to ensure the outcomes are the expected ones';
 $string['unknownexceptioninfo'] = 'There was a problem with Selenium or your browser. Please ensure you are using the latest version of Selenium. Error:';
 $string['viewsteps'] = 'Filter';
+$string['warndirrootconfigfound'] = 'A configuration file was found at {$a}. This file is not automatically updated and may become stale. We recommend removing this file.';
 $string['wheninfo'] = 'When. Action that provokes an event';
 $string['wrongbehatsetup'] = 'Something is wrong with the behat setup and so step definitions cannot be listed: <b>{$a->errormsg}</b><br/><br/>Please check:<ul>
 <li>$CFG->behat_dataroot, $CFG->behat_prefix and $CFG->behat_wwwroot are set in config.php with different values from $CFG->dataroot, $CFG->prefix and $CFG->wwwroot.</li>
@@ -156,7 +156,7 @@ Feature: Set up contextual data for tests
    And I log in as "user5"
    And I should see "You are logged in as"
    And I am on "Course 1" course homepage
-    And I should see "You can not enrol yourself in this course."
+    And I should see "You cannot enrol yourself in this course."

  Scenario: Add modules
    Given the following "courses" exist:
@@ -21,5 +21,5 @@ Feature: Transform date time string arguments
    And I log in as "teacher1"
    And I am on "Course 1" course homepage
    And I follow "Test assignment name"
-    And I should see "##yesterday##l, j F Y##"
+    And I should see "##yesterday##%A, %d %B %Y##"
    And I log out
@@ -6,14 +6,18 @@ Feature: Edit capabilities

  Background:
    Given the following "users" exist:
-      | username | firstname | lastname | email |
-      | teacher1 | Teacher | 1 | teacher1@example.com |
+      | username | firstname | lastname  |
+      | teacher1 | Teacher   | 1         |
+      | tutor    | Teaching  | Assistant |
+      | student  | Student   | One       |
    And the following "courses" exist:
-      | fullname | shortname | category |
-      | Course 1 | C1 | 0 |
+      | fullname | shortname |
+      | Course 1 | C1        |
    And the following "course enrolments" exist:
-      | user | course | role |
-      | teacher1 | C1 | editingteacher |
+      | user     | course | role           |
+      | teacher1 | C1     | editingteacher |
+      | tutor    | C1     | teacher        |
+      | student  | C1     | student        |

  Scenario: Default system capabilities modification
    Given I log in as "admin"
@@ -60,3 +64,25 @@ Feature: Edit capabilities
    Then "mod/forum:deleteanypost" capability has "Prohibit" permission
    And "mod/forum:editanypost" capability has "Prevent" permission
    And "mod/forum:addquestion" capability has "Allow" permission
+
+  @javascript
+  Scenario: Edit permissions escapes role names correctly
+    When I am on the "C1" "Course" page logged in as "admin"
+    And I navigate to "Edit settings" in current page administration
+    And I set the following fields to these values:
+      | Your word for 'Teacher'             | Teacher >= editing  |
+      | Your word for 'Non-editing teacher' | Teacher < "editing" |
+      | Your word for 'Student'             | Studier & 'learner' |
+    And I press "Save and display"
+    And I navigate to course participants
+    Then I should see "Teacher >= editing (Teacher)" in the "Teacher 1" "table_row"
+    And I should see "Teacher < \"editing\" (Non-editing teacher)" in the "Teaching Assistant" "table_row"
+    And I should see "Studier & 'learner' (Student)" in the "Student One" "table_row"
+    And I navigate to "Users > Permissions" in current page administration
+    And I should see "Teacher >= editing" in the "mod/forum:replypost" "table_row"
+    And I should see "Teacher < \"editing\"" in the "mod/forum:replypost" "table_row"
+    And I should see "Studier & 'learner'" in the "mod/forum:replypost" "table_row"
+    And I follow "Prohibit"
+    And "Teacher >= editing" "button" in the "Prohibit role" "dialogue" should be visible
+    And "Teacher < \"editing\"" "button" in the "Prohibit role" "dialogue" should be visible
+    And "Studier & 'learner'" "button" in the "Prohibit role" "dialogue" should be visible
@@ -0,0 +1,30 @@
+@tool_behat
+Feature: Verify that the inplace editable field works as expected
+  In order to use behat step definitions
+  As a test write
+  I need to ensure that the inplace editable works in forms
+
+  Background:
+    Given the following "course" exists:
+      | fullname  | Course 1 |
+      | shortname | C1       |
+    And the following "activities" exist:
+      | activity | course | name                | idnumber |
+      | forum    | C1     | My first forum      | forum1   |
+      | assign   | C1     | My first assignment | assign1  |
+      | quiz     | C1     | My first quiz       | quiz1    |
+    And I log in as "admin"
+    And I am on "Course 1" course homepage with editing mode on
+
+  @javascript
+  Scenario: Using an inplace editable updates the name of an activity
+    When I set the field "Edit title" in the "My first assignment" "activity" to "Coursework submission"
+    Then I should see "Coursework submission"
+    And I should not see "My first assignment"
+    But I should see "My first forum"
+    And I should see "My first quiz"
+    And I set the field "Edit title" in the "Coursework submission" "activity" to "My first assignment"
+    And I should not see "Coursework submission"
+    But I should see "My first assignment"
+    And I should see "My first forum"
+    And I should see "My first quiz"
@@ -0,0 +1,52 @@
+@tool_behat
+Feature: Verify that keyboard steps work as expected
+  In order to use behat step definitions
+  As a test writer
+  I need to verify that the keyboard steps work as expected
+
+  @javascript
+  Scenario: Typing keys into a field causes them to be input
+    Given the following "users" exist:
+      | username | email                        | firstname | lastname | password    |
+      | saffronr | saffron.rutledge@example.com | Saffron   | Rutledge | flowerpower |
+    Given I click on "Log in" "link"
+    And I click on "Username" "field"
+    When I type "saffronr"
+    And I press the tab key
+    And I type "flowerpower"
+    And I press enter
+    Then I should see "You are logged in as Saffron Rutledge"
+
+  @javascript
+  Scenario: Using tab changes focus to the next or previous field
+    Given I click on "Log in" "link"
+    And I click on "Username" "field"
+    And the focused element is "Username" "field"
+    When I press the tab key
+    Then the focused element is "Password" "field"
+
+    And I press the shift tab key
+    And the focused element is "Username" "field"
+
+  @javascript
+  Scenario: Using the arrow keys allows me to navigate through menus
+    Given the following "users" exist:
+      | username | email                        | firstname | lastname |
+      | saffronr | saffron.rutledge@example.com | Saffron   | Rutledge |
+    And I log in as "saffronr"
+    And I click on "Saffron Rutledge" "link" in the ".usermenu" "css_element"
+    When I press the up key
+    Then the focused element is "Log out" "link"
+
+  @javascript
+  Scenario: The escape key can be used to close a dialogue
+    Given the following "course" exists:
+     | fullname  | C1|
+     | shortname | C1 |
+    And I log in as "admin"
+    And I am on "C1" course homepage
+    And I navigate to course participants
+    And I press "Enrol users"
+    And "Enrol users" "dialogue" should be visible
+    When I press the escape key
+    Then "Enrol users" "dialogue" should not be visible
@@ -14,8 +14,6 @@ Feature: Forms manipulation
    Then the field "First name" matches value "Field value"
    And the "Select a country" select box should contain "Japan"
    And the field "New password" matches value "TestPass"
-    And I take focus off "Update profile" "button"
-    And I press "Update profile"

  @javascript
  Scenario: Expand all fieldsets and advanced elements
@@ -60,12 +60,12 @@ class tool_capability_settings_form extends moodleform {
        $form->addElement('select', 'roles', get_string('roleslabel', 'tool_capability'), $roles, $attributes);
        $form->setType('roles', PARAM_TEXT);

-        $form->addElement('checkbox', 'onlydiff',
-                get_string('filters', 'tool_capability'),
-                get_string('onlydiff', 'tool_capability'));
+        $filters = [];
+        $filters[] = $form->createElement('checkbox', 'onlydiff',  get_string('onlydiff', 'tool_capability'));
        $form->setType('onlydiff', PARAM_BOOL);
+        $form->addGroup($filters, 'filters', get_string('filters', 'tool_capability'), array('<br>'), false);

        $form->addElement('submit', 'submitbutton', get_string('getreport', 'tool_capability'));
    }

-}
+}
@@ -53,7 +53,12 @@ function tool_capability_calculate_role_data($capability, array $roles) {
    $sql = 'SELECT DISTINCT con.path, 1
              FROM {context} con
              JOIN {role_capabilities} rc ON rc.contextid = con.id
-             WHERE capability = ? '.$sqlroletest;
+             WHERE capability = ? ' .
+            $sqlroletest .
+            // Context path should never be null, but can happen in old database with
+            // bad data (e.g. a course_module where the corresponding course no longer exists).
+            // We need to leave these out of the report to prevent errors.
+            ' AND con.path IS NOT NULL';
    $relevantpaths = $DB->get_records_sql_menu($sql, $params);
    $requiredcontexts = array($systemcontext->id);
    foreach ($relevantpaths as $path => $notused) {
@@ -88,6 +93,10 @@ function tool_capability_calculate_role_data($capability, array $roles) {

    // Put the role capabilities into the context tree.
    foreach ($rolecaps as $rolecap) {
+        if (!isset($contexts[$rolecap->contextid])) {
+            // Skip capabilities in orphaned contexts that are not in the tree.
+            continue;
+        }
        $contexts[$rolecap->contextid]->rolecapabilities[$rolecap->roleid] = $rolecap->permission;
    }

@@ -99,4 +108,4 @@ function tool_capability_calculate_role_data($capability, array $roles) {
    }

    return $contexts;
-}
+}
@@ -0,0 +1,88 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Tests for the capability overview helper functions.
+ *
+ * @package   tool_capability
+ * @copyright 2021 The Open University
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later.
+ */
+
+defined('MOODLE_INTERNAL') || die();
+global $CFG;
+require_once($CFG->dirroot . '/' . $CFG->admin . '/tool/capability/locallib.php');
+
+
+/**
+ * Tests for the capability overview helper functions.
+ */
+class tool_capability_locallib_testcase extends advanced_testcase {
+
+    /**
+     * Test the function that gets the data - simple case.
+     */
+    public function test_tool_capability_calculate_role_data() {
+        global $DB;
+
+        $data = tool_capability_calculate_role_data('mod/quiz:attempt', get_all_roles());
+
+        $systcontext = context_system::instance();
+        $studentroleid = $DB->get_field('role', 'id', ['shortname' => 'student']);
+
+        $this->assertArrayHasKey($systcontext->id, $data);
+        $this->assertCount(1, $data);
+        foreach ($data[$systcontext->id]->rolecapabilities as $roleid => $permission) {
+            if ($roleid == $studentroleid) {
+                $this->assertEquals(CAP_ALLOW, $permission);
+            } else {
+                $this->assertEquals(CAP_INHERIT, $permission);
+            }
+        }
+    }
+
+    /**
+     * Test the function that gets the data - simple case.
+     */
+    public function test_tool_capability_calculate_role_data_orphan_contexts() {
+        global $DB;
+        $this->resetAfterTest();
+
+        // This simulates a situation that seems to happen sometimes, where
+        // we end up with contexts with path = NULL in the database.
+        $systcontext = context_system::instance();
+        $generator = $this->getDataGenerator();
+        $course = $generator->create_course();
+        $coursecontext = context_course::instance($course->id);
+        $studentroleid = $DB->get_field('role', 'id', ['shortname' => 'student']);
+        role_change_permission($studentroleid, $coursecontext, 'mod/quiz:attempt', CAP_PREVENT);
+        // This is where we simulate the breakage.
+        $DB->set_field('context', 'path', null, ['id' => $coursecontext->id]);
+
+        // Now call the function. We mainly just want to know there is no exception.
+        $data = tool_capability_calculate_role_data('mod/quiz:attempt', get_all_roles());
+
+        $this->assertArrayHasKey($systcontext->id, $data);
+        $this->assertCount(1, $data);
+        foreach ($data[$systcontext->id]->rolecapabilities as $roleid => $permission) {
+            if ($roleid == $studentroleid) {
+                $this->assertEquals(CAP_ALLOW, $permission);
+            } else {
+                $this->assertEquals(CAP_INHERIT, $permission);
+            }
+        }
+    }
+}
@@ -39,7 +39,7 @@ class tool_customlang_utils {
    const ROUGH_NUMBER_OF_STRINGS = 16500;

    /** @var array cache of {@link self::list_components()} results */
-    protected static $components = null;
+    private static $components = null;

    /**
     * This class can not be instantiated
@@ -54,28 +54,30 @@ class tool_customlang_utils {
     */
    public static function list_components() {

-        $list['moodle'] = 'core';
+        if (self::$components === null) {
+            $list['moodle'] = 'core';

-        $coresubsystems = core_component::get_core_subsystems();
-        ksort($coresubsystems); // should be but just in case
-        foreach ($coresubsystems as $name => $location) {
-            $list[$name] = 'core_'.$name;
-        }
+            $coresubsystems = core_component::get_core_subsystems();
+            ksort($coresubsystems); // Should be but just in case.
+            foreach ($coresubsystems as $name => $location) {
+                $list[$name] = 'core_' . $name;
+            }

-        $plugintypes = core_component::get_plugin_types();
-        foreach ($plugintypes as $type => $location) {
-            $pluginlist = core_component::get_plugin_list($type);
-            foreach ($pluginlist as $name => $ununsed) {
-                if ($type == 'mod') {
-                    // Plugin names are now automatically validated.
-                    $list[$name] = $type.'_'.$name;
-                } else {
-                    $list[$type.'_'.$name] = $type.'_'.$name;
+            $plugintypes = core_component::get_plugin_types();
+            foreach ($plugintypes as $type => $location) {
+                $pluginlist = core_component::get_plugin_list($type);
+                foreach ($pluginlist as $name => $ununsed) {
+                    if ($type == 'mod') {
+                        // Plugin names are now automatically validated.
+                        $list[$name] = $type . '_' . $name;
+                    } else {
+                        $list[$type . '_' . $name] = $type . '_' . $name;
+                    }
                }
            }
+            self::$components = $list;
        }
-
-        return $list;
+        return self::$components;
    }

    /**
@@ -211,14 +213,18 @@ class tool_customlang_utils {
            return false;
        }

-        // get all customized strings from updated components
+        list($insql, $inparams) = $DB->get_in_or_equal(self::list_components());
+
+        // Get all customized strings from updated valid components.
        $sql = "SELECT s.*, c.name AS component
                  FROM {tool_customlang} s
                  JOIN {tool_customlang_components} c ON s.componentid = c.id
                 WHERE s.lang = ?
                       AND (s.local IS NOT NULL OR s.modified = 1)
+                       AND c.name $insql
              ORDER BY componentid, stringid";
-        $strings = $DB->get_records_sql($sql, array($lang));
+        array_unshift($inparams, $lang);
+        $strings = $DB->get_records_sql($sql, $inparams);

        $files = array();
        foreach ($strings as $string) {
@@ -336,11 +342,9 @@ EOF
     * @return string|boolean filename eg 'moodle.php' or 'workshop.php', false if not found
     */
    protected static function get_component_filename($component) {
-        if (is_null(self::$components)) {
-            self::$components = self::list_components();
-        }
+
        $return = false;
-        foreach (self::$components as $legacy => $normalized) {
+        foreach (self::list_components() as $legacy => $normalized) {
            if ($component === $normalized) {
                $return = $legacy.'.php';
                break;
@@ -5,7 +5,10 @@ Feature: Within a moodle instance, an administrator should be able to modify lan
  I need to be able to access and change values in the the language customisation of the language pack.

  Background:
-    Given I log in as "admin"
+    # This is a very slow running test and on slow databases can take minutes to complete.
+    Given I mark this test as slow setting a timeout factor of 4
+
+    And I log in as "admin"
    And I navigate to "Language > Language customisation" in site administration
    And I set the field "lng" to "en"
    And I press "Open language pack for editing"
@@ -4,6 +4,10 @@ Feature: Within a moodle instance, an administrator should be able to export mod
  As an admin
  I need to be able to export the php-files of the language customisation of a language.

+  Background:
+    # This is a very slow running feature and on slow databases can take minutes to complete.
+    Given I mark this test as slow setting a timeout factor of 4
+
  @javascript
  Scenario: Export button should not appear if no customization is made
    Given I log in as "admin"
@@ -5,7 +5,10 @@ Feature: Within a moodle instance, an administrator should be able to import mod
  I need to be able to import the zips and php files of the language customisation of a language.

  Background:
-    Given I log in as "admin"
+    # This is a very slow running test and on slow databases can take minutes to complete.
+    Given I mark this test as slow setting a timeout factor of 4
+
+    And I log in as "admin"
    And I navigate to "Language > Language customisation" in site administration
    And I set the field "lng" to "en"
    And I click on "Import custom strings" "button"
@@ -5,8 +5,11 @@ Feature: Within a moodle instance, an administrator should be able to import lan
  I need to be able to import only some language customisation strings depending on some conditions.

  Background:
+    # This is a very slow running feature and on slow databases can take minutes to complete.
+    Given I mark this test as slow setting a timeout factor of 4
+
    # Add one customization.
-    Given I log in as "admin"
+    And I log in as "admin"
    And I navigate to "Language > Language customisation" in site administration
    And I set the field "lng" to "en"
    And I press "Open language pack for editing"
@@ -46,7 +46,7 @@ Feature: Manage data requests
    And I open the action menu in "John Doe" "table_row"
    And I should see "View the request"
    But I should not see "Mark as complete"
-    And I press key "27" in ".moodle-actionmenu" "css_element"
+    And I press the escape key
    And I open the action menu in "Jane Doe" "table_row"
    And I choose "Mark as complete" in the open action menu
    And I should see "Do you really want to mark this user enquiry as complete?"
@@ -10,16 +10,12 @@ Feature: Manage data storage purposes
    And I open the action menu in "region-main" "region"
    And I choose "Purposes" in the open action menu
    And I press "Add purpose"
-    And I set the field "Name" to "Purpose 1"
-    And I set the field "Description" to "Purpose 1 description"
-    And I click on ".form-autocomplete-downarrow" "css_element" in the "Lawful bases" "form_row"
-    And I click on "Contract (GDPR Art. 6.1(b))" "list_item"
-    And I click on "Legal obligation (GDPR Art 6.1(c))" "list_item"
-    And I press key "27" in the field "Lawful bases"
-    And I click on ".form-autocomplete-downarrow" "css_element" in the "Sensitive personal data processing reasons" "form_row"
-    And I click on "Explicit consent (GDPR Art. 9.2(a))" "list_item"
-    And I press key "27" in the field "Sensitive personal data processing reasons"
-    And I set the field "retentionperiodnumber" to "2"
+    And I set the following fields to these values:
+      | Name                                       | Purpose 1                                                      |
+      | Description                                | Purpose 1 description                                          |
+      | Lawful bases                               | Contract (GDPR Art. 6.1(b)),Legal obligation (GDPR Art 6.1(c)) |
+      | Sensitive personal data processing reasons | Explicit consent (GDPR Art. 9.2(a))                            |
+      | retentionperiodnumber                      | 2                                                              |
    When I press "Save"
    Then I should see "Purpose 1" in the "List of data purposes" "table"
    And I should see "Contract (GDPR Art. 6.1(b))" in the "Purpose 1" "table_row"
@@ -31,14 +27,13 @@ Feature: Manage data storage purposes
  Scenario: Update a data storage purpose
    Given I open the action menu in "Purpose 1" "table_row"
    And I choose "Edit" in the open action menu
-    And I set the field "Name" to "Purpose 1 edited"
-    And I set the field "Description" to "Purpose 1 description edited"
-    And I click on "Legal obligation (GDPR Art 6.1(c))" "text" in the ".form-autocomplete-selection" "css_element"
-    And I click on ".form-autocomplete-downarrow" "css_element" in the "Lawful bases" "form_row"
-    And I click on "Vital interests (GDPR Art. 6.1(d))" "list_item"
-    And I press key "27" in the field "Lawful bases"
-    And I set the field "retentionperiodnumber" to "3"
-    And I click on "protected" "checkbox"
+    And I set the following fields to these values:
+      | Name                                       | Purpose 1 edited                                                |
+      | Description                                | Purpose 1 description edited                                    |
+      | Lawful bases                               | Contract (GDPR Art. 6.1(b)), Vital interests (GDPR Art. 6.1(d)) |
+      | Sensitive personal data processing reasons | Explicit consent (GDPR Art. 9.2(a))                             |
+      | retentionperiodnumber                      | 3                                                               |
+      | protected                                  | 1                                                               |
    When I press "Save changes"
    Then I should see "Purpose 1 edited" in the "List of data purposes" "table"
    And I should see "Purpose 1 description edited" in the "Purpose 1 edited" "table_row"
@@ -5,7 +5,10 @@ Feature: View the httpsreplace report
  I need to be able to automatically replace http links

  Background: Create some http links
-    Given I am on site homepage
+    # This is a slow running feature and on slow databases can take over 30 seconds to complete.
+    Given I mark this test as slow setting a timeout factor of 2
+
+    And I am on site homepage
    And the following "courses" exist:
      | fullname | shortname | category | summary                                                                                                     |
      | Course 1 | C1        | 0        | <img src="http://intentionally.unavailable/test.png"> <img src="http://download.moodle.org/unittest/test.jpg"> |
@@ -22,8 +22,8 @@
 * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */
 namespace tool_langimport\output;
-defined('MOODLE_INTERNAL') || die();

+use core_collator;
 use moodle_url;
 use renderable;
 use renderer_base;
@@ -95,6 +95,8 @@ class langimport_page implements renderable, templatable {

        if (!empty($this->availablelanguages)) {
            $data->toinstalloptions = [];
+
+            core_collator::asort($this->availablelanguages);
            foreach ($this->availablelanguages as $code => $language) {
                $option = new stdClass();
                $option->value = $code;
@@ -10,12 +10,10 @@ Feature: Delete custom licenses
    And I navigate to "Licence > Licence manager" in site administration
    And I click on "Create licence" "link"
    And I set the following fields to these values:
-    | shortname      | MIT                                 |
-    | fullname       | MIT Licence                         |
-    | source         | https://opensource.org/licenses/MIT |
-    | version[day]   | 1                                   |
-    | version[month] | March                               |
-    | version[year]  | 2019                                |
+    | shortname       | MIT                                 |
+    | fullname        | MIT Licence                         |
+    | source          | https://opensource.org/licenses/MIT |
+    | Licence version | ##1 March 2019##                    |
    And I press "Save changes"
    And I click on "Delete" "icon" in the "MIT" "table_row"
    When I click on "Save changes" "button" in the "Delete licence" "dialogue"
@@ -9,12 +9,10 @@ Feature: Custom licences
    And I navigate to "Licence > Licence manager" in site administration
    And I click on "Create licence" "link"
    And I set the following fields to these values:
-      | shortname      | MIT                                 |
-      | fullname       | MIT Licence                         |
-      | source         | https://opensource.org/licenses/MIT |
-      | version[day]   | 1                                   |
-      | version[month] | January                             |
-      | version[year]  | 2020                                |
+      | shortname       | MIT                                 |
+      | fullname        | MIT Licence                         |
+      | source          | https://opensource.org/licenses/MIT |
+      | Licence version | ##first day of January 2020##       |
    When I press "Save changes"
    Then I should see "Licence manager"
    And I should see "MIT Licence" in the "MIT" "table_row"
@@ -25,12 +23,10 @@ Feature: Custom licences
    And I navigate to "Licence > Licence manager" in site administration
    And I click on "Create licence" "link"
    And I set the following fields to these values:
-      | shortname      | MIT                                 |
-      | fullname       | MIT Licence                         |
-      | source         | opensource.org/licenses/MIT         |
-      | version[day]   | 1                                   |
-      | version[month] | January                             |
-      | version[year]  | 2020                                |
+      | shortname       | MIT                         |
+      | fullname        | MIT Licence                 |
+      | source          | opensource.org/licenses/MIT |
+      | Licence version | ##2020-01-01##              |
    When I press "Save changes"
    Then I should see "Invalid source URL"
    And I set the following fields to these values:
@@ -49,12 +45,10 @@ Feature: Custom licences
    And I navigate to "Licence > Licence manager" in site administration
    And I click on "Create licence" "link"
    And I set the following fields to these values:
-      | shortname      | MIT                                 |
-      | fullname       | MIT Licence                         |
-      | source         | https://opensource.org/licenses/MIT |
-      | version[day]   | 1                                   |
-      | version[month] | March                               |
-      | version[year]  | 2019                                |
+      | shortname       | MIT                                 |
+      | fullname        | MIT Licence                         |
+      | source          | https://opensource.org/licenses/MIT |
+      | Licence version | ##1 March 2019##                    |
    When I press "Save changes"
    Then I should see "Licence manager"
    And I should see "2019030100" in the "MIT" "table_row"
@@ -65,12 +59,10 @@ Feature: Custom licences
    And I navigate to "Licence > Licence manager" in site administration
    And I click on "Create licence" "link"
    And I set the following fields to these values:
-      | shortname      | MIT                                 |
-      | fullname       | MIT Licence                         |
-      | source         | https://opensource.org/licenses/MIT |
-      | version[day]   | 1                                   |
-      | version[month] | March                               |
-      | version[year]  | 2019                                |
+      | shortname       | MIT                                 |
+      | fullname        | MIT Licence                         |
+      | source          | https://opensource.org/licenses/MIT |
+      | Licence version | ##1 Mar 2019##                      |
    And I press "Save changes"
    And I should see "Licence manager"
    And I should see "MIT Licence" in the "MIT" "table_row"
@@ -53,11 +53,11 @@ Feature: See the competencies for an activity on the course competencies page.
    Then I should see "Test-Comp1"
    And I should see "Test-Comp2"
    And I set the field "Filter competencies by resource or activity" to "PageName1"
-    And I press key "13" in the field "Filter competencies by resource or activity"
+    And I press the enter key
    And I should see "Test-Comp1"
    And I should not see "Test-Comp2"
    And I set the field "Filter competencies by resource or activity" to "PageName2"
-    And I press key "13" in the field "Filter competencies by resource or activity"
+    And I press the enter key
    And I should not see "Test-Comp1"
    And I should not see "Test-Comp2"
    And I should see "No competencies have been linked to this activity or resource."
@@ -30,7 +30,7 @@ Feature: Manage plearning plan
    And I click on ".template-userplans" "css_element" in the "Science template" "table_row"
    And I open the autocomplete suggestions list
    And I click on "Admin User" item in the autocomplete list
-    And I press key "27" in the field "Select users to create learning plans for"
+    And I press the escape key
    When I click on "Create learning plans" "button"
    Then I should see "A learning plan was created"
    And I should see "Admin User" in the "Science template" "table_row"
@@ -53,9 +53,7 @@ Feature: Manage plearning plan
    And I follow "Home"
    And I navigate to "Competencies > Learning plan templates" in site administration
    And I click on ".template-cohorts" "css_element" in the "Science template cohort" "table_row"
-    And I click on ".form-autocomplete-downarrow" "css_element"
-    And I click on "cohort plan" item in the autocomplete list
-    And I press key "27" in the field "Select cohorts to sync"
+    And I set the field "Select cohorts to sync" to "cohort plan"
    When I click on "Add cohorts" "button"
    Then I should see "2 learning plans were created."
    And I follow "Learning plan templates"
@@ -221,7 +221,7 @@ class api {
        }

        // Identity providers.
-        $authsequence = get_enabled_auth_plugins(true);
+        $authsequence = get_enabled_auth_plugins();
        $identityproviders = \auth_plugin_base::get_identity_providers($authsequence);
        $identityprovidersdata = \auth_plugin_base::prepare_identity_providers_for_output($identityproviders, $OUTPUT);
        if (!empty($identityprovidersdata)) {
@@ -1,2 +1,2 @@
-define ("tool_policy/acceptances_filter_datasource",["jquery","core/ajax","core/notification"],function(a,b,c){return{list:function list(b,c){var d=[],e=a(b),f=a(b).data("originaloptionsjson"),g=e.val();a.each(f,function(b,e){if(""!==a.trim(c)&&-1===e.label.toLocaleLowerCase().indexOf(c.toLocaleLowerCase())){return!0}if(-1<a.inArray(e.value,g)){return!0}d.push(e);return!0});var h=new a.Deferred;h.resolve(d);return h.promise()},processResults:function processResults(b,c){var d=[];a.each(c,function(a,b){d.push({value:b.value,label:b.label})});return d},transport:function transport(a,b,d){this.list(a,b).then(d).catch(c.exception)}}});
+define ("tool_policy/acceptances_filter_datasource",["jquery","core/ajax","core/notification"],function(a,b,c){return{list:function list(b,c){var d=[],e=a(b),f=a(b).data("originaloptionsjson"),g=e.val();a.each(f,function(b,e){if(""!==c.trim()&&-1===e.label.toLocaleLowerCase().indexOf(c.toLocaleLowerCase())){return!0}if(-1<a.inArray(e.value,g)){return!0}d.push(e);return!0});var h=new a.Deferred;h.resolve(d);return h.promise()},processResults:function processResults(b,c){var d=[];a.each(c,function(a,b){d.push({value:b.value,label:b.label})});return d},transport:function transport(a,b,d){this.list(a,b).then(d).catch(c.exception)}}});
 //# sourceMappingURL=acceptances_filter_datasource.min.js.map
@@ -41,7 +41,7 @@ define(['jquery', 'core/ajax', 'core/notification'], function($, Ajax, Notificat
            var selectedFilters = el.val();
            $.each(originalOptions, function(index, option) {
                // Skip option if it does not contain the query string.
-                if ($.trim(query) !== '' && option.label.toLocaleLowerCase().indexOf(query.toLocaleLowerCase()) === -1) {
+                if (query.trim() !== '' && option.label.toLocaleLowerCase().indexOf(query.toLocaleLowerCase()) === -1) {
                    return true;
                }
                // Skip filters that have already been selected.
@@ -641,6 +641,6 @@ class acceptances_table extends \table_sql {
            }
            return ''; // User agreed by themselves.
        }
-        return null;
+        return parent::other_cols($column, $row);
    }
 }
@@ -1,2 +1,2 @@
-define ("tool_templatelibrary/search",["jquery","core/ajax","core/log","core/notification","core/templates","core/config"],function(a,b,c,d,e,f){var g=function(b){e.render("tool_templatelibrary/search_results",{templates:b}).done(function(b,c){e.replaceNode(a("[data-region=\"searchresults\"]"),b,c)}).fail(d.exception)},h=function(c){var e=a("[data-field=\"component\"]").val(),f=a("[data-region=\"list-templates\"] [data-region=\"input\"]").val();if(""!==f){a("[data-region=\"list-templates\"] [data-action=\"clearsearch\"]").removeClass("d-none")}else{a("[data-region=\"list-templates\"] [data-action=\"clearsearch\"]").addClass("d-none")}document.location.hash=f;b.call([{methodname:"tool_templatelibrary_list_templates",args:{component:e,search:f,themename:c},done:g,fail:d.exception}],!0,!1)},i=null,j=function(a,b){if(null!==i){window.clearTimeout(i)}i=window.setTimeout(function(){a();i=null},b)},k=function(){j(h.bind(this,f.theme),400)};a("[data-region=\"list-templates\"]").on("change","[data-field=\"component\"]",k);a("[data-region=\"list-templates\"]").on("input","[data-region=\"input\"]",k);a("[data-action=\"clearsearch\"]").on("click",function(){a("[data-region=\"input\"]").val("");h(f.theme);a(this).addClass("d-none")});a("[data-region=\"input\"]").val(document.location.hash.replace("#",""));h(f.theme);return{}});
+define ("tool_templatelibrary/search",["jquery","core/ajax","core/log","core/notification","core/templates","core/config"],function(a,b,c,d,e,f){var g=function(b){e.render("tool_templatelibrary/search_results",{templates:b}).done(function(b,c){e.replaceNode(a("[data-region=\"searchresults\"]"),b,c)}).fail(d.exception)},h=function(c){var e=a("[data-field=\"component\"]").val(),f=a("[data-region=\"list-templates\"] [data-region=\"input\"]").val();if(""!==f){a("[data-region=\"list-templates\"] [data-action=\"clearsearch\"]").removeClass("d-none")}else{a("[data-region=\"list-templates\"] [data-action=\"clearsearch\"]").addClass("d-none")}b.call([{methodname:"tool_templatelibrary_list_templates",args:{component:e,search:f,themename:c},done:g,fail:d.exception}],!0,!1)},i=null,j=function(a,b){if(null!==i){window.clearTimeout(i)}i=window.setTimeout(function(){a();i=null},b)},k=function(){j(h.bind(this,f.theme),400)};a("[data-region=\"list-templates\"]").on("change","[data-field=\"component\"]",k);a("[data-region=\"list-templates\"]").on("input","[data-region=\"input\"]",k);a("[data-action=\"clearsearch\"]").on("click",function(){a("[data-region=\"input\"]").val("");h(f.theme);a(this).addClass("d-none")});h(f.theme);return{}});
 //# sourceMappingURL=search.min.js.map
@@ -52,9 +52,8 @@ define(['jquery', 'core/ajax', 'core/log', 'core/notification', 'core/templates'
        } else {
            $('[data-region="list-templates"] [data-action="clearsearch"]').addClass('d-none');
        }
-        // Trigger the search.
-        document.location.hash = searchStr;

+        // Trigger the search.
        ajax.call([
            {methodname: 'tool_templatelibrary_list_templates',
              args: {component: componentStr, search: searchStr, themename: themename},
@@ -96,7 +95,6 @@ define(['jquery', 'core/ajax', 'core/log', 'core/notification', 'core/templates'
        $(this).addClass('d-none');
    });

-    $('[data-region="input"]').val(document.location.hash.replace('#', ''));
    refreshSearch(config.theme);
    return {};
 });
@@ -38,6 +38,22 @@ use tool_templatelibrary\api;
 */
 class list_templates_page implements renderable, templatable {

+    /** @var string $component The currently selected component */
+    protected $component;
+    /** @var string $search The current search */
+    protected $search;
+
+    /**
+     * Template page constructor
+     *
+     * @param string $component
+     * @param string $search
+     */
+    public function __construct(string $component = '', string $search = '') {
+        $this->component = $component;
+        $this->search = $search;
+    }
+
    /**
     * Export this data so it can be used as the context for a mustache template.
     *
@@ -46,6 +62,7 @@ class list_templates_page implements renderable, templatable {
    public function export_for_template(renderer_base $output) {
        $data = new stdClass();
        $data->allcomponents = array();
+        $data->search = $this->search;
        $fulltemplatenames = api::list_templates();
        $pluginmanager = core_plugin_manager::instance();
        $components = array();
@@ -59,6 +76,7 @@ class list_templates_page implements renderable, templatable {
        foreach ($components as $component) {
            $info = new stdClass();
            $info->component = $component;
+            $info->selected = ($component === $this->component);
            if (strpos($component, 'core') === 0) {
                $info->name = get_string('coresubsystem', 'tool_templatelibrary', $component);
            } else {
@@ -72,10 +72,10 @@
        {{/label}}

        {{$element}}
-            <select id="selectcomponent" class="form-control" data-field="component">
+            <select id="selectcomponent" name="component" class="form-control" data-field="component">
                <option value="">{{#str}}all, tool_templatelibrary{{/str}}</option>
                {{#allcomponents}}
-                    <option value="{{component}}">{{name}}</option>
+                    <option value="{{component}}" {{#selected}}selected{{/selected}}>{{name}}</option>
                {{/allcomponents}}
            </select>
        {{/element}}
@@ -84,10 +84,10 @@
    {{< core_form/element-template }}
        {{$element}}
            {{< core/search_input_auto }}
-                {{$label}}{{{ searchstring }}}{{/label}}
-                {{$placeholder}}{{#str}}
-                    search, core
-                {{/str}}{{/placeholder}}
+                {{$label}}
+                    {{#str}} search, tool_templatelibrary {{/str}}
+                {{/label}}
+                {{$value}}{{ search }}{{/value}}
            {{/ core/search_input_auto }}
        {{/element}}
    {{/ core_form/element-template }}
@@ -132,12 +132,12 @@ Feature: Upload users
    # Boost check.
    And I log in as "jonest"
    And I am on "Maths" course homepage
-    And "Turn editing on" "button" should not exist
+    And "Calendar" "link" should be visible
    And I log out
    # Classic check.
    And I log in as "reznor"
    And I am on "Maths" course homepage
-    And "Turn editing on" "button" should exist
+    And "Calendar" "link" should not be visible

  @javascript
  Scenario: Upload users setting their user theme when allowuserthemes is false
@@ -305,7 +305,7 @@ class admin_uploaduser_form2 extends moodleform {
        $mform->setAdvanced('url');

        $mform->addElement('text', 'idnumber', get_string('idnumber'), 'maxlength="255" size="25"');
-        $mform->setType('idnumber', PARAM_NOTAGS);
+        $mform->setType('idnumber', core_user::get_property_type('idnumber'));
        $mform->setForceLtr('idnumber');

        $mform->addElement('text', 'institution', get_string('institution'), 'maxlength="255" size="25"');
@@ -76,10 +76,10 @@ Feature: Apply accessibility to a tour
    And "input[tabindex],button[tabindex]" "css_element" should exist
    When I click on "Next" "button"
    Then "input[aria-describedby^='tour-step-tool_usertours'],button[aria-describedby^='tour-step-tool_usertours']" "css_element" should not exist
-    And "input[tabindex],button[tabindex]" "css_element" should not exist
+    And "input[tabindex]:not([tabindex='-1']),button[tabindex]:not([tabindex='-1'])" "css_element" should not exist
    When I click on "Previous" "button"
    Then "input[aria-describedby^='tour-step-tool_usertours'],button[aria-describedby^='tour-step-tool_usertours']" "css_element" should exist
    And "input[tabindex],button[tabindex]" "css_element" should exist
    When I click on "End tour" "button"
    Then "input[aria-describedby^='tour-step-tool_usertours'],button[aria-describedby^='tour-step-tool_usertours']" "css_element" should not exist
-    And "input[tabindex],button[tabindex]" "css_element" should not exist
+    And "input[tabindex]:not([tabindex='0']),button[tabindex]:not([tabindex='0'])" "css_element" should not exist
@@ -93,7 +93,7 @@ class create_xml_file extends XMLDBAction {
        $c.= '        </KEYS>' . "\n";
        $c.= '      </TABLE>' . "\n";
        $c.= '    </TABLES>' . "\n";
-        $c.= '  </XMLDB>';
+        $c.= '  </XMLDB>' . "\n";

        if (!file_put_contents($file, $c)) {
            $errormsg = 'Error creando fichero ' . $file;
@@ -55,10 +55,7 @@ Feature: Manage analytics models
    And I choose "Create model" in the open action menu
    And I set the field "Enabled" to "Enable"
    And I select "__core_course__analytics__target__course_completion" from the "target" singleselect
-    And I open the autocomplete suggestions list
-    And I click on "Read actions amount" item in the autocomplete list
-    And I open the autocomplete suggestions list
-    And I click on "Any write action in the course" item in the autocomplete list
+    And I set the field "Indicators" to "Read actions amount, Any write action in the course"
    And I select "__core__analytics__time_splitting__single_range" from the "timesplitting" singleselect
    And I press "Save changes"
    Then I should see "No predictions available yet" in the "Students at risk of not meeting the course completion conditions" "table_row"
@@ -1,3 +1,3 @@
 Description of phpCAS 1.3.8 library import

-* downloaded from http://downloads.jasig.org/cas-clients/php/current/
+* downloaded source code from https://github.com/apereo/phpCAS/releases
@@ -4,7 +4,7 @@
    <location>CAS</location>
    <name>CAS</name>
    <license>Apache</license>
-    <version>1.3.7</version>
+    <version>1.3.8</version>
    <licenseversion>2.0</licenseversion>
  </library>
 </libraries>
@@ -178,10 +178,10 @@ class auth_plugin_email extends auth_plugin_base {
            if ($user->auth != $this->authtype) {
                return AUTH_CONFIRM_ERROR;

-            } else if ($user->secret == $confirmsecret && $user->confirmed) {
+            } else if ($user->secret === $confirmsecret && $user->confirmed) {
                return AUTH_CONFIRM_ALREADY;

-            } else if ($user->secret == $confirmsecret) {   // They have provided the secret key to get in
+            } else if ($user->secret === $confirmsecret) {   // They have provided the secret key to get in
                $DB->set_field("user", "confirmed", 1, array("id"=>$user->id));

                if ($wantsurl = get_user_preferences('auth_email_wantsurl', false, $user)) {
@@ -257,5 +257,3 @@ class auth_plugin_email extends auth_plugin_base {
    }

 }
-
-
@@ -598,10 +598,10 @@ class auth_plugin_ldap extends auth_plugin_base {
            if ($user->auth != $this->authtype) {
                return AUTH_CONFIRM_ERROR;

-            } else if ($user->secret == $confirmsecret && $user->confirmed) {
+            } else if ($user->secret === $confirmsecret && $user->confirmed) {
                return AUTH_CONFIRM_ALREADY;

-            } else if ($user->secret == $confirmsecret) {   // They have provided the secret key to get in
+            } else if ($user->secret === $confirmsecret) {   // They have provided the secret key to get in
                if (!$this->user_activate($username)) {
                    return AUTH_CONFIRM_FAIL;
                }
@@ -8,7 +8,7 @@ $PAGE->set_context(context_system::instance());
 // Define variables used in page
 $site = get_site();

-$authsequence = get_enabled_auth_plugins(true); // auths, in sequence
+$authsequence = get_enabled_auth_plugins(); // Auths, in sequence.
 if (!in_array('ldap', $authsequence, true)) {
    print_error('ldap_isdisabled', 'auth');
 }
@@ -8,7 +8,7 @@ $PAGE->set_context(context_system::instance());
 // Define variables used in page
 $site = get_site();

-$authsequence = get_enabled_auth_plugins(true); // auths, in sequence
+$authsequence = get_enabled_auth_plugins(); // Auths, in sequence.
 if (!in_array('ldap', $authsequence, true)) {
    print_error('ldap_isdisabled', 'auth');
 }
@@ -10,7 +10,7 @@ require(__DIR__.'/../../config.php');

 $PAGE->set_context(context_system::instance());

-$authsequence = get_enabled_auth_plugins(true); // auths, in sequence
+$authsequence = get_enabled_auth_plugins(); // Auths, in sequence.
 if (!in_array('ldap', $authsequence, true)) {
    print_error('ldap_isdisabled', 'auth');
 }
@@ -543,7 +543,7 @@ class auth_ldap_plugin_testcase extends advanced_testcase {
    }

    protected function enable_plugin() {
-        $auths = get_enabled_auth_plugins(true);
+        $auths = get_enabled_auth_plugins();
        if (!in_array('ldap', $auths)) {
            $auths[] = 'ldap';

@@ -372,10 +372,10 @@ class auth extends \auth_plugin_base {
            if ($user->auth != $this->authtype) {
                return AUTH_CONFIRM_ERROR;

-            } else if ($user->secret == $confirmsecret && $user->confirmed) {
+            } else if ($user->secret === $confirmsecret && $user->confirmed) {
                return AUTH_CONFIRM_ALREADY;

-            } else if ($user->secret == $confirmsecret) {   // They have provided the secret key to get in.
+            } else if ($user->secret === $confirmsecret) {   // They have provided the secret key to get in.
                $DB->set_field("user", "confirmed", 1, array("id" => $user->id));
                return AUTH_CONFIRM_OK;
            }
@@ -27,6 +27,9 @@ require_once('../../config.php');
 $issuerid = required_param('id', PARAM_INT);
 $wantsurl = new moodle_url(optional_param('wantsurl', '', PARAM_URL));

+$PAGE->set_context(context_system::instance());
+$PAGE->set_url(new moodle_url('/auth/oauth2/login.php', ['id' => $issuerid]));
+
 require_sesskey();

 if (!\auth_oauth2\api::is_enabled()) {
@@ -182,7 +182,8 @@ How to customize the way the Shibboleth user data is used in Moodle
 Among the Shibboleth settings in Moodle there is a field that should contain a
 path to a php file that can be used as data manipulation hook.
 You can use this if you want to further process the way your Shibboleth
-attributes are used in Moodle.
+attributes are used in Moodle. Due to security reasons this file cannot be
+located within the current site data directory ($CFG->dataroot).

 Example 1: Your Shibboleth federation uses an attribute that specifies the
           user's preferred language, but the content of this attribute is not
@@ -0,0 +1,75 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Special setting for auth_shibboleth convert_data.
+ *
+ * @package    auth_shibboleth
+ * @copyright  2020 Mihail Geshoski
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+/**
+ * Admin settings class for the convert_data option.
+ *
+ * @package    auth_shibboleth
+ * @copyright  2020 Mihail Geshoski
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class auth_shibboleth_admin_setting_convert_data extends admin_setting_configfile {
+
+    /**
+     * Constructor.
+     *
+     * @param string $name
+     * @param string $visiblename
+     * @param string $description
+     * @param mixed $defaultdirectory
+     */
+    public function __construct($name, $visiblename, $description, $defaultdirectory) {
+        parent::__construct($name, $visiblename, $description, $defaultdirectory);
+    }
+
+    /**
+     * Validate the file path (location).
+     *
+     * This method ensures that the file defined as a data modification API exists and is not located in the site
+     * data directory ($CFG->dataroot). We should prohibit using files from the site data directory as this introduces
+     * security vulnerabilities.
+     *
+     * @param string $filepath The path to the file.
+     * @return mixed bool true for success or string:error on failure.
+     */
+    public function validate($filepath) {
+        global $CFG;
+
+        if (empty($filepath)) {
+            return true;
+        }
+
+        // Fail if the file does not exist or it is not readable by the webserver process.
+        if (!is_readable($filepath)) {
+            return get_string('auth_shib_convert_data_warning', 'auth_shibboleth');
+        }
+
+        // Fail if the absolute file path matches the currently defined dataroot path.
+        if (preg_match('/' . preg_quote($CFG->dataroot, '/') . '/', realpath($filepath))) {
+            return get_string('auth_shib_convert_data_filepath_warning', 'auth_shibboleth');
+        }
+
+        return true;
+    }
+}
@@ -30,7 +30,7 @@ defined('MOODLE_INTERNAL') || die();
 * @return bool result
 */
 function xmldb_auth_shibboleth_upgrade($oldversion) {
-    global $CFG, $DB;
+    global $CFG, $DB, $OUTPUT;

    // Automatically generated Moodle v3.5.0 release upgrade line.
    // Put any upgrade step following this.
@@ -50,5 +50,27 @@ function xmldb_auth_shibboleth_upgrade($oldversion) {
    // Automatically generated Moodle v3.10.0 release upgrade line.
    // Put any upgrade step following this.

+    if ($oldversion < 2020110901) {
+        // The 'Data modification API' setting in the Shibboleth authentication plugin can no longer be configured
+        // to use files located within the site data directory, as it exposes the site to security risks. Therefore,
+        // we need to find every existing case and reset the 'Data modification API' setting to its default value.
+
+        $convertdataconfig = get_config('auth_shibboleth', 'convert_data');
+
+        if (preg_match('/' . preg_quote($CFG->dataroot, '/') . '/', realpath($convertdataconfig))) {
+            set_config('convert_data', '', 'auth_shibboleth');
+
+            $warn = 'Your \'Data modification API\' setting in the Shibboleth authentication plugin is currently
+            configured to use a file located within the current site data directory ($CFG->dataroot). You are no
+            longer able to use files from within this directory for this purpose as it exposes your site to security
+            risks. This setting has been reset to its default value. Please reconfigure it by providing a path
+            to a file which is not located within the site data directory.';
+
+            echo $OUTPUT->notification($warn, 'notifyproblem');
+        }
+
+        upgrade_plugin_savepoint(true, 2020110901, 'auth', 'shibboleth');
+    }
+
    return true;
 }
@@ -38,6 +38,7 @@ $string['auth_shibboleth_select_organization'] = 'For authentication via Shibbol
 $string['auth_shib_convert_data'] = 'Data modification API';
 $string['auth_shib_convert_data_description'] = 'You can use this API to further modify the data provided by Shibboleth. Read the <a href="{$a}">README</a> for further instructions.';
 $string['auth_shib_convert_data_warning'] = 'The file does not exist or is not readable by the webserver process!';
+$string['auth_shib_convert_data_filepath_warning'] = 'You cannot use a file that is located within the current site data directory ($CFG->dataroot) as the data modification API.';
 $string['auth_shib_changepasswordurl'] = 'Password-change URL';
 $string['auth_shib_idp_list'] = 'Identity providers';
 $string['auth_shib_idp_list_description'] = 'Provide a list of Identity Provider entityIDs to let the user choose from on the login page.<br />On each line there must be a comma-separated tuple for entityID of the IdP (see the Shibboleth metadata file) and Name of IdP as it shall be displayed in the drop-down list.<br />As an optional third parameter you can add the location of a Shibboleth session initiator that shall be used in case your Moodle installation is part of a multi federation setup.';
@@ -28,6 +28,7 @@ if ($ADMIN->fulltree) {
    // We use a couple of custom admin settings since we need to massage the data before it is inserted into the DB.
    require_once($CFG->dirroot.'/auth/shibboleth/classes/admin_setting_special_wayf_select.php');
    require_once($CFG->dirroot.'/auth/shibboleth/classes/admin_setting_special_idp_configtextarea.php');
+    require_once($CFG->dirroot.'/auth/shibboleth/classes/admin_setting_special_convert_data_configfile.php');

    // Introductory explanation.
    $readmeurl = (new moodle_url('/auth/shibboleth/README.txt'))->out();
@@ -38,8 +39,8 @@ if ($ADMIN->fulltree) {
    $settings->add(new admin_setting_configtext('auth_shibboleth/user_attribute', get_string('username'),
            get_string('auth_shib_username_description', 'auth_shibboleth'), '', PARAM_RAW));

-    // COnvert Data configuration file.
-    $settings->add(new admin_setting_configfile('auth_shibboleth/convert_data',
+    // Convert Data configuration file.
+    $settings->add(new auth_shibboleth_admin_setting_convert_data('auth_shibboleth/convert_data',
            get_string('auth_shib_convert_data', 'auth_shibboleth'),
            get_string('auth_shib_convert_data_description', 'auth_shibboleth', $readmeurl), ''));

@@ -1,6 +1,11 @@
 This files describes API changes in /auth/shibboleth/*,
 information provided here is intended especially for developers.

+=== 3.10.1 ===
+
+* The 'Data modification API' (convert_data) setting can no longer be configured to use files located within the
+  current site data directory ($CFG->dataroot), as it exposes the site to security risks.
+
 === 3.5.2 ===

 * Moved the public function unserializesession in auth/shibboleth/logout.php to auth/shibboleth/classes/helper.php and
@@ -25,6 +25,6 @@

 defined('MOODLE_INTERNAL') || die();

-$plugin->version   = 2020110900;        // The current plugin version (Date: YYYYMMDDXX)
+$plugin->version   = 2020110901;        // The current plugin version (Date: YYYYMMDDXX)
 $plugin->requires  = 2020110300;        // Requires this Moodle version
 $plugin->component = 'auth_shibboleth'; // Full name of the plugin (used for diagnostics)
@@ -835,6 +835,9 @@ class backup_badges_structure_step extends backup_structure_step {
    }

    protected function define_structure() {
+        global $CFG;
+
+        require_once($CFG->libdir . '/badgeslib.php');

        // Define each element separated.

@@ -886,7 +889,15 @@ class backup_badges_structure_step extends backup_structure_step {

        // Define sources.

-        $badge->set_source_table('badge', array('courseid' => backup::VAR_COURSEID));
+        $parametersql = '
+                SELECT *
+                FROM {badge}
+                WHERE courseid = :courseid
+                AND status != ' . BADGE_STATUS_ARCHIVED;
+        $parameterparams = [
+            'courseid' => backup::VAR_COURSEID
+        ];
+        $badge->set_source_sql($parametersql, $parameterparams);
        $criterion->set_source_table('badge_criteria', array('badgeid' => backup::VAR_PARENTID));
        $endorsement->set_source_table('badge_endorsement', array('badgeid' => backup::VAR_PARENTID));

@@ -82,16 +82,17 @@ class restore_quiz_decode_testcase extends \core_privacy\tests\provider_testcase

        $newcm = duplicate_module($course, get_fast_modinfo($course)->get_cm($quiz->cmid));

-        $sql = "SELECT qa.answer
+        $sql = "SELECT qa.id, qa.answer
                  FROM {quiz} q
             LEFT JOIN {quiz_slots} qs ON qs.quizid = q.id
             LEFT JOIN {question_answers} qa ON qa.question = qs.questionid
                 WHERE q.id = :quizid";
        $params = array('quizid' => $newcm->instance);
-        $answers = $DB->get_fieldset_sql($sql, $params);
-        $this->assertEquals($CFG->wwwroot . '/course/view.php?id=' . $course->id, $answers[0]);
-        $this->assertEquals($CFG->wwwroot . '/mod/quiz/view.php?id=' . $quiz->cmid, $answers[1]);
-        $this->assertEquals($CFG->wwwroot . '/grade/report/index.php?id=' . $quiz->cmid, $answers[2]);
-        $this->assertEquals($CFG->wwwroot . '/mod/quiz/index.php?id=' . $quiz->cmid, $answers[3]);
+        $answers = $DB->get_records_sql_menu($sql, $params);
+
+        $this->assertEquals($CFG->wwwroot . '/course/view.php?id=' . $course->id, $answers[$firstanswer->id]);
+        $this->assertEquals($CFG->wwwroot . '/mod/quiz/view.php?id=' . $quiz->cmid, $answers[$secondanswer->id]);
+        $this->assertEquals($CFG->wwwroot . '/grade/report/index.php?id=' . $quiz->cmid, $answers[$thirdanswer->id]);
+        $this->assertEquals($CFG->wwwroot . '/mod/quiz/index.php?id=' . $quiz->cmid, $answers[$fourthanswer->id]);
    }
 }
@@ -1078,8 +1078,8 @@ abstract class restore_dbops {
                                $localpath = $filesystem->get_local_path_from_storedfile($storedfile);
                                $fs->create_file_from_pathname($file, $localpath);
                            } else if ($filesystem->is_file_readable_remotely_by_storedfile($storedfile)) {
-                                $url = $filesystem->get_remote_path_from_storedfile($storedfile);
-                                $fs->create_file_from_url($file, $url);
+                                $remotepath = $filesystem->get_remote_path_from_storedfile($storedfile);
+                                $fs->create_file_from_pathname($file, $remotepath);
                            } else if ($filesystem->is_file_readable_locally_by_storedfile($storedfile, true)) {
                                $localpath = $filesystem->get_local_path_from_storedfile($storedfile, true);
                                $fs->create_file_from_pathname($file, $localpath);
@@ -116,7 +116,9 @@ class backup_ui_stage_initial extends backup_ui_stage {
                        if (isset($data->$name) &&  $data->$name != $setting->get_value()) {
                            $setting->set_value($data->$name);
                            $changes++;
-                        } else if (!isset($data->$name) && $setting->get_ui_type() == backup_setting::UI_HTML_CHECKBOX && $setting->get_value()) {
+                        } else if (!isset($data->$name) && $setting->get_value() &&
+                                $setting->get_ui_type() == backup_setting::UI_HTML_CHECKBOX &&
+                                $setting->get_status() !== backup_setting::LOCKED_BY_HIERARCHY) {
                            $setting->set_value(0);
                            $changes++;
                        }
@@ -173,7 +173,7 @@ class client extends \core\oauth2\client {
     * @return moodle_url url of callback
     */
    public static function callback_url() {
-        return new moodle_url('/badges/oauth2callback.php');
+        return new moodle_url('/admin/oauth2callback.php');
    }

    /**
@@ -1,57 +0,0 @@
-<?php
-// This file is part of Moodle - http://moodle.org/
-//
-// Moodle is free software: you can redistribute it and/or modify
-// it under the terms of the GNU General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// Moodle is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License
-// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
-
-/**
- * Verify authorization callback.
- *
- * @package    core_badges
- * @copyright  2020 Tung Thai
- * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
- * @author     Tung Thai <Tung.ThaiDuc@nashtechglobal.com>
- */
-require_once(__DIR__ . '/../config.php');
-
-$error = optional_param('error', '', PARAM_RAW);
-
-if ($error) {
-    $message = optional_param('error_description', '', PARAM_RAW);
-    if ($message) {
-        print_error($message);
-    } else {
-        print_error($error);
-    }
-    die();
-}
-
-require_login();
-
-// The authorization code generated by the authorization server.
-$code = required_param('code', PARAM_RAW);
-$scope = required_param('scope', PARAM_RAW);
-
-// The state parameter we've given (used in moodle as a redirect url).
-$state = required_param('state', PARAM_LOCALURL);
-
-$redirecturl = new moodle_url($state);
-$params = $redirecturl->params();
-
-if (isset($params['sesskey']) and confirm_sesskey($params['sesskey'])) {
-    $redirecturl->param('oauth2code', $code);
-    $redirecturl->param('scope', $scope);
-    redirect($redirecturl);
-} else {
-    print_error('invalidsesskey');
-}
@@ -322,7 +322,15 @@ class core_badges_renderer extends plugin_renderer_base {
        $badgeclass = $ibadge->badgeclass;
        $badge = new badge($ibadge->badgeid);
        $now = time();
-        $expiration = isset($issued['expires']) ? $issued['expires'] : $now + 86400;
+        if (isset($issued['expires'])) {
+            if (!is_numeric($issued['expires'])) {
+                $issued['expires'] = strtotime($issued['expires']);
+            }
+            $expiration = $issued['expires'];
+        } else {
+            $expiration = $now + 86400;
+        }
+
        $badgeimage = is_array($badgeclass['image']) ? $badgeclass['image']['id'] : $badgeclass['image'];
        $languages = get_string_manager()->get_list_of_languages();

@@ -432,9 +440,6 @@ class core_badges_renderer extends plugin_renderer_base {
        }
        $dl[get_string('dateawarded', 'badges')] = userdate($issued['issuedOn']);
        if (isset($issued['expires'])) {
-            if (!is_numeric($issued['expires'])) {
-                $issued['expires'] = strtotime($issued['expires']);
-            }
            if ($issued['expires'] < $now) {
                $dl[get_string('expirydate', 'badges')] = userdate($issued['expires']) . get_string('warnexpired', 'badges');

@@ -1145,6 +1145,7 @@ class core_badges_badgeslib_testcase extends advanced_testcase {
        $data['password'] = 'test';
        if ($isadmin || $updatetest) {
            $this->setAdminUser();
+            $lastmax = $DB->get_field_sql('SELECT MAX(sortorder) FROM {badge_external_backpack}');
            $backpack = badges_create_site_backpack((object) $data);
        }

@@ -1156,8 +1157,9 @@ class core_badges_badgeslib_testcase extends advanced_testcase {
                badges_update_site_backpack($backpack, (object)$data);
            }
            $record = $DB->get_record('badge_external_backpack', ['id' => $backpack]);
-            $this->assertEquals($record->backpackweburl, $data['backpackweburl']);
-            $this->assertEquals($record->backpackapiurl, $data['backpackapiurl']);
+            $this->assertEquals($data['backpackweburl'], $record->backpackweburl);
+            $this->assertEquals($data['backpackapiurl'], $record->backpackapiurl);
+            $this->assertEquals($lastmax + 1, $record->sortorder);
            $record = $DB->get_record('badge_backpack', ['userid' => 0]);
            $this->assertNotEmpty($record);
        } else {
@@ -120,7 +120,7 @@ Feature: Backpack badges
    And I click on "Delete" "button" in the "Delete site backpack" "dialogue"
    Then I should see "The site backpack has been deleted."
    And I should not see "https://dc.imsglobal.org"
-    And "Delete" "button" should not exist
+    And "Delete" "button" should not be visible

  @javascript
  Scenario: Add a new site backpack with authentication details checkbox
@@ -131,27 +131,27 @@ Feature: Backpack badges
    And I set the field "backpackapiurl" to "http://backpackapiurl.cat"
    And I set the field "backpackweburl" to "http://backpackweburl.cat"
    And I set the field "apiversion" to "2.1"
-    Then "Include authentication details with the backpack" "checkbox" should not exist
+    Then "Include authentication details with the backpack" "checkbox" should not be visible
    And I should not see "Badge issuer email address"
    And I should not see "Badge issuer password"
    And I set the field "apiversion" to "1"
-    And "Include authentication details with the backpack" "checkbox" should exist
+    And "Include authentication details with the backpack" "checkbox" should be visible
    And I click on "includeauthdetails" "checkbox"
    And I should see "Badge issuer email address"
    And I should not see "Badge issuer password"
    And I set the field "apiversion" to "2"
-    And "Include authentication details with the backpack" "checkbox" should exist
+    And "Include authentication details with the backpack" "checkbox" should be visible
    And I should see "Badge issuer email address"
    And I should see "Badge issuer password"
    And I set the field "backpackemail" to "test@test.com"
    And I set the field "password" to "123456"
    And I press "Save changes"
    And I click on "Edit" "link" in the "http://backpackweburl.cat" "table_row"
-    And "input[name=includeauthdetails][type=checkbox][value=1]" "css_element" should exist
+    And the field "Include authentication details with the backpack" matches value "1"
    And I click on "includeauthdetails" "checkbox"
    And I press "Save changes"
    And I click on "Edit" "link" in the "http://backpackweburl.cat" "table_row"
-    And "input[name=includeauthdetails][type=checkbox][value=1]" "css_element" should not exist
+    And the field "Include authentication details with the backpack" matches value "0"
    And I click on "includeauthdetails" "checkbox"
    And I should not see "test@test.com"
    And I log out
@@ -7,7 +7,7 @@ default:
    Behat\MinkExtension:
      base_url: 'http://localhost:8000'
      goutte: null
-      selenium2: null
+      webdriver: null
    Moodle\BehatExtension:
      moodledirroot: /Should/Change/To/Moodle/www/dir
      steps_definitions: {  }
@@ -512,6 +512,10 @@ class block_activity_results extends block_base {
                $fields = implode(',', $fields);
                $users = $DB->get_records_list('user', 'id', $userids, '', $fields);

+                // If configured to view user idnumber, ensure current user can see it.
+                $extrafields = get_extra_user_fields($this->context);
+                $canviewidnumber = (array_search('idnumber', $extrafields) !== false);
+
                // Ready for output!
                if ($activity->gradetype == GRADE_TYPE_SCALE) {
                    // We must display the results using scales.
@@ -537,10 +541,14 @@ class block_activity_results extends block_base {
                    }
                    $this->content->text .= '</h6></caption><colgroup class="number" />';
                    $this->content->text .= '<colgroup class="name" /><colgroup class="grade" /><tbody>';
+
                    foreach ($best as $userid => $gradeid) {
                        switch ($nameformat) {
                            case B_ACTIVITYRESULTS_NAME_FORMAT_ID:
-                                $thisname = get_string('user').' '.$users[$userid]->idnumber;
+                                $thisname = get_string('user');
+                                if ($canviewidnumber) {
+                                    $thisname .= ' ' . s($users[$userid]->idnumber);
+                                }
                            break;
                            case B_ACTIVITYRESULTS_NAME_FORMAT_ANON:
                                $thisname = get_string('user');
@@ -603,7 +611,10 @@ class block_activity_results extends block_base {
                    foreach ($worst as $userid => $gradeid) {
                        switch ($nameformat) {
                            case B_ACTIVITYRESULTS_NAME_FORMAT_ID:
-                                $thisname = get_string('user').' '.$users[$userid]->idnumber;
+                                $thisname = get_string('user');
+                                if ($canviewidnumber) {
+                                    $thisname .= ' ' . s($users[$userid]->idnumber);
+                                };
                            break;
                            case B_ACTIVITYRESULTS_NAME_FORMAT_ANON:
                                $thisname = get_string('user');
@@ -139,7 +139,9 @@ Feature: The activity results block displays student high scores
    And I should see "70.00" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple high scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 3 |
@@ -78,7 +78,9 @@ Feature: The activity results block displays students high scores in group as sc
    And I should see "Good" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple high scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 3 |
@@ -110,7 +110,9 @@ Feature: The activity results block displays student in group high scores as sca
    And I should see "Good" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple high scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 3 |
@@ -123,11 +125,13 @@ Feature: The activity results block displays student in group high scores as sca
    And I should see "Very good" in the "Activity results" "block"
    And I should see "Good" in the "Activity results" "block"
    And I log out
+    # Students cannot see user identity fields.
    And I log in as "student1"
    And I am on "Course 1" course homepage
-    And I should see "User S1" in the "Activity results" "block"
+    And I should see "User" in the "Activity results" "block"
+    And I should not see "User S1" in the "Activity results" "block"
    And I should see "Excellent!" in the "Activity results" "block"
-    And I should see "User S2" in the "Activity results" "block"
+    And I should not see "User S2" in the "Activity results" "block"
    And I should see "Very good" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple high scores using anonymous names
@@ -184,7 +184,9 @@ Feature: The activity results block displays student in separate groups scores
    And I should see "90.00" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple high scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 3 |
@@ -198,11 +200,13 @@ Feature: The activity results block displays student in separate groups scores
    And I should see "85.00%" in the "Activity results" "block"
    And I should see "75.00%" in the "Activity results" "block"
    And I log out
+    # Students cannot see user identity fields.
    And I log in as "student1"
    And I am on "Course 1" course homepage
-    And I should see "User S1" in the "Activity results" "block"
+    And I should see "User" in the "Activity results" "block"
+    And I should not see "User S1" in the "Activity results" "block"
    And I should see "100.00%" in the "Activity results" "block"
-    And I should see "User S2" in the "Activity results" "block"
+    And I should not see "User S2" in the "Activity results" "block"
    And I should see "90.00%" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple high scores using anonymous names
@@ -168,7 +168,9 @@ Feature: The activity results block displays student in visible groups scores
    And I should see "75.00" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple high scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 3 |
@@ -128,7 +128,9 @@ Feature: The activity results block displays student low scores
    And I should see "70.00" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple low scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 0 |
@@ -79,7 +79,9 @@ Feature: The activity results block displays student low scores as scales
    And I should see "Good" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple low scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 0 |
@@ -108,7 +108,9 @@ Feature: The activity results block displays students in groups low scores as sc
    And I should see "Good" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple high scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 0 |
@@ -120,11 +122,13 @@ Feature: The activity results block displays students in groups low scores as sc
    And I should see "Very good" in the "Activity results" "block"
    And I should see "Good" in the "Activity results" "block"
    And I log out
+    # Students cannot see user identity fields.
    And I log in as "student5"
    And I am on "Course 1" course homepage
-    And I should see "User S5" in the "Activity results" "block"
+    And I should see "User" in the "Activity results" "block"
+    And I should not see "User S5" in the "Activity results" "block"
    And I should see "Good" in the "Activity results" "block"
-    And I should see "User S6" in the "Activity results" "block"
+    And I should not see "User S6" in the "Activity results" "block"
    And I should see "Average" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple high scores using anonymous names
@@ -178,7 +178,9 @@ Feature: The activity results block displays students in separate groups scores
    And I should see "70.00" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple low scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 0 |
@@ -191,11 +193,13 @@ Feature: The activity results block displays students in separate groups scores
    And I should see "85.00%" in the "Activity results" "block"
    And I should see "75.00%" in the "Activity results" "block"
    And I log out
+    # Students cannot see user identity fields.
    And I log in as "student1"
    And I am on "Course 1" course homepage
-    And I should see "User S1" in the "Activity results" "block"
+    And I should see "User" in the "Activity results" "block"
+    And I should not see "User S1" in the "Activity results" "block"
    And I should see "100.00%" in the "Activity results" "block"
-    And I should see "User S2" in the "Activity results" "block"
+    And I should not see "User S2" in the "Activity results" "block"
    And I should see "90.00%" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple low scores using anonymous names
@@ -166,7 +166,9 @@ Feature: The activity results block displays student in visible groups low score
    And I should see "75.00" in the "Activity results" "block"

  Scenario: Try to configure the block on the course page to show multiple low scores using ID numbers
-    Given I add the "Activity results" block
+    Given the following config values are set as admin:
+      | showuseridentity | idnumber,email |
+    And I add the "Activity results" block
    When I configure the "Activity results" block
    And I set the following fields to these values:
      | id_config_showbest | 0 |
@@ -114,7 +114,8 @@ class block_blog_recent extends block_base {

            foreach ($entries as $entryid => $entry) {
                $viewblogurl->param('entryid', $entryid);
-                $entrylink = html_writer::link($viewblogurl, shorten_text($entry->subject));
+                $entrylink = html_writer::link($viewblogurl, shorten_text(format_string($entry->subject, true,
+                    ['context' => $context])));
                $entrieslist[] = $entrylink;
            }

@@ -16,6 +16,8 @@ Feature: Students can use the recent blog entries block to view recent entries o
      | user | course | role |
      | teacher1 | C1 | editingteacher |
      | student1 | C1 | student |
+    And the "multilang" filter is "on"
+    And the "multilang" filter applies to "content and headings"
    And I log in as "teacher1"
    And I am on "Course 1" course homepage with editing mode on
    And I add the "Blog menu" block
@@ -27,13 +29,13 @@ Feature: Students can use the recent blog entries block to view recent entries o
    And I am on "Course 1" course homepage
    And I follow "Add an entry about this course"
    When I set the following fields to these values:
-      | Entry title | S1 First Blog |
+      | Entry title | S1 First Blog <span lang="RU" class="multilang">RUSSIAN</span><span lang="EN" class="multilang">ENGLISH</span> |
      | Blog entry body | This is my awesome blog! |
    And I press "Save changes"
-    Then I should see "S1 First Blog"
+    Then I should see "S1 First Blog ENGLISH"
    And I should see "This is my awesome blog!"
    And I am on "Course 1" course homepage
-    And I should see "S1 First Blog"
+    And I should see "S1 First Blog ENGLISH"
    And I follow "S1 First Blog"
    And I should see "This is my awesome blog!"

@@ -101,7 +101,7 @@ class block_login extends block_base {
                $this->content->text .= '<div><a href="'.$forgot.'">'.get_string('forgotaccount').'</a></div>';
            }

-            $authsequence = get_enabled_auth_plugins(true); // Get all auths, in sequence.
+            $authsequence = get_enabled_auth_plugins(); // Get all auths, in sequence.
            $potentialidps = array();
            foreach ($authsequence as $authname) {
                $authplugin = get_auth_plugin($authname);
@@ -543,11 +543,9 @@ function(

        // Filter out all pagination options which are too large for the amount of courses user is enrolled in.
        var totalCourseCount = parseInt(root.find(Selectors.courseView.region).attr('data-totalcoursecount'), 10);
-        if (totalCourseCount) {
-            itemsPerPage = itemsPerPage.filter(function(pagingOption) {
-                return pagingOption.value < totalCourseCount;
-            });
-        }
+        itemsPerPage = itemsPerPage.filter(function(pagingOption) {
+            return pagingOption.value < totalCourseCount || pagingOption.value === 0;
+        });

        var filters = getFilterValues(root);
        var config = $.extend({}, DEFAULT_PAGED_CONTENT_CONFIG);
@@ -602,7 +600,8 @@ function(
                                pageCourses = $.merge(loadedPages[currentPage].courses, courses.slice(0, nextPageStart));
                            }
                        } else {
-                            nextPageStart = pageData.limit;
+                            // When the page limit is zero, there is only one page of courses, no start for next page.
+                            nextPageStart = pageData.limit || false;
                            pageCourses = (pageData.limit > 0) ? courses.slice(0, pageData.limit) : courses;
                        }

@@ -611,8 +610,8 @@ function(
                            courses: pageCourses
                        };

-                        // Set up the next page
-                        var remainingCourses = nextPageStart ? courses.slice(nextPageStart, courses.length) : [];
+                        // Set up the next page (if there is more than one page).
+                        var remainingCourses = nextPageStart !== false ? courses.slice(nextPageStart, courses.length) : [];
                        if (remainingCourses.length) {
                            loadedPages[currentPage + 1] = {
                                courses: remainingCourses
@@ -202,8 +202,9 @@ class main implements renderable, templatable {
        // Check and remember the given view.
        $this->view = $view ? $view : BLOCK_MYOVERVIEW_VIEW_CARD;

-        // Check and remember the given page size.
-        if ($paging == BLOCK_MYOVERVIEW_PAGING_ALL) {
+        // Check and remember the given page size, `null` indicates no page size set
+        // while a `0` indicates a paging size of `All`.
+        if (!is_null($paging) && $paging == BLOCK_MYOVERVIEW_PAGING_ALL) {
            $this->paging = BLOCK_MYOVERVIEW_PAGING_ALL;
        } else {
            $this->paging = $paging ? $paging : BLOCK_MYOVERVIEW_PAGING_12;
@@ -370,8 +371,9 @@ class main implements renderable, templatable {
        $select = "instanceid $csql AND fieldid = :fieldid";
        $params['fieldid'] = $fieldid;
        $distinctablevalue = $DB->sql_compare_text('value');
-        $values = $DB->get_records_select_menu('customfield_data', $select, $params, $DB->sql_order_by_text('value'),
+        $values = $DB->get_records_select_menu('customfield_data', $select, $params, '',
            "DISTINCT $distinctablevalue, $distinctablevalue AS value2");
+        \core_collator::asort($values, \core_collator::SORT_NATURAL);
        $values = array_filter($values);
        if (!$values) {
            return [];
@@ -7,30 +7,30 @@ Feature: The my overview block allows users to persistence of their page limits
      | student1 | Student   | X        | student1@example.com | S1       |
    And the following "courses" exist:
      | fullname | shortname | category |
-      | Course 1 | C1        | 0        |
-      | Course 2 | C2        | 0        |
-      | Course 3 | C3        | 0        |
-      | Course 4 | C4        | 0        |
-      | Course 5 | C5        | 0        |
-      | Course 6 | C6        | 0        |
-      | Course 7 | C7        | 0        |
-      | Course 8 | C8        | 0        |
-      | Course 9 | C9        | 0        |
+      | Course 1 | C01        | 0        |
+      | Course 2 | C02        | 0        |
+      | Course 3 | C03        | 0        |
+      | Course 4 | C04        | 0        |
+      | Course 5 | C05        | 0        |
+      | Course 6 | C06        | 0        |
+      | Course 7 | C07        | 0        |
+      | Course 8 | C08        | 0        |
+      | Course 9 | C09        | 0        |
      | Course 10 | C10        | 0        |
      | Course 11 | C11        | 0        |
      | Course 12 | C12        | 0        |
      | Course 13 | C13        | 0        |
    And the following "course enrolments" exist:
      | user | course | role |
-      | student1 | C1 | student |
-      | student1 | C2 | student |
-      | student1 | C3 | student |
-      | student1 | C4 | student |
-      | student1 | C5 | student |
-      | student1 | C6 | student |
-      | student1 | C7 | student |
-      | student1 | C8 | student |
-      | student1 | C9 | student |
+      | student1 | C01 | student |
+      | student1 | C02 | student |
+      | student1 | C03 | student |
+      | student1 | C04 | student |
+      | student1 | C05 | student |
+      | student1 | C06 | student |
+      | student1 | C07 | student |
+      | student1 | C08 | student |
+      | student1 | C09 | student |
      | student1 | C10 | student |
      | student1 | C11 | student |
      | student1 | C12 | student |
@@ -38,8 +38,8 @@ Feature: The my overview block allows users to persistence of their page limits

  Scenario: Toggle the page limit between page reloads
    Given I log in as "student1"
-    When I click on "[data-toggle='dropdown']" "css_element" in the "Course overview" "block"
-    And I click on "All" "link"
+    When I click on "[data-action='limit-toggle']" "css_element" in the "Course overview" "block"
+    And I click on "All" "link" in the ".dropdown-menu.show" "css_element"
    Then I should see "Course 13"
    And I reload the page
    Then I should see "Course 13"
@@ -47,8 +47,8 @@ Feature: The my overview block allows users to persistence of their page limits

  Scenario: Toggle the page limit between grouping changes
    Given I log in as "student1"
-    When I click on "[data-toggle='dropdown']" "css_element" in the "Course overview" "block"
-    And I click on "All" "link"
+    When I click on "[data-action='limit-toggle']" "css_element" in the "Course overview" "block"
+    And I click on "All" "link" in the ".dropdown-menu.show" "css_element"
    And I click on "All (except removed from view)" "button" in the "Course overview" "block"
    And I click on "In progress" "link" in the "Course overview" "block"
    Then I should see "Course 13"
@@ -0,0 +1,191 @@
+@block @block_myoverview @javascript
+Feature: My overview block pagination
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email                | idnumber |
+      | student1 | Student   | X        | student1@example.com | S1       |
+    And the following "courses" exist:
+      | fullname | shortname | category |
+      | Course 01 | C1       | 0        |
+      | Course 02 | C2       | 0        |
+      | Course 03 | C3       | 0        |
+      | Course 04 | C4       | 0        |
+      | Course 05 | C5       | 0        |
+      | Course 06 | C6       | 0        |
+      | Course 07 | C7       | 0        |
+      | Course 08 | C8       | 0        |
+      | Course 09 | C9       | 0        |
+      | Course 10 | C10      | 0        |
+      | Course 11 | C11      | 0        |
+      | Course 12 | C12      | 0        |
+      | Course 13 | C13      | 0        |
+      | Course 14 | C14      | 0        |
+      | Course 15 | C15      | 0        |
+      | Course 16 | C16      | 0        |
+      | Course 17 | C17      | 0        |
+      | Course 18 | C18      | 0        |
+      | Course 19 | C19      | 0        |
+      | Course 20 | C20      | 0        |
+      | Course 21 | C21      | 0        |
+      | Course 22 | C22      | 0        |
+      | Course 23 | C23      | 0        |
+      | Course 24 | C24      | 0        |
+      | Course 25 | C25      | 0        |
+
+  Scenario: The pagination controls should be hidden if I am not enrolled in any courses
+    When I log in as "student1"
+    Then I should see "No courses" in the "Course overview" "block"
+    And I should not see "Show" in the "Course overview" "block"
+    And ".block_myoverview .dropdown-menu.show" "css_element" should not be visible
+    And ".block_myoverview [data-control='next']" "css_element" should not be visible
+    And ".block_myoverview [data-control='previous']" "css_element" should not be visible
+    And I log out
+
+  Scenario: The pagination controls should be hidden if I am enrolled in 12 courses or less
+    Given the following "course enrolments" exist:
+      | user | course | role |
+      | student1 | C1 | student |
+      | student1 | C2 | student |
+      | student1 | C3 | student |
+      | student1 | C4 | student |
+      | student1 | C5 | student |
+      | student1 | C6 | student |
+      | student1 | C7 | student |
+      | student1 | C8 | student |
+      | student1 | C9 | student |
+      | student1 | C10 | student |
+      | student1 | C11 | student |
+      | student1 | C12 | student |
+    When I log in as "student1"
+    Then I should not see "Show" in the "Course overview" "block"
+    And ".block_myoverview .dropdown-menu.show" "css_element" should not be visible
+    And ".block_myoverview [data-control='next']" "css_element" should not be visible
+    And ".block_myoverview [data-control='previous']" "css_element" should not be visible
+    And I log out
+
+  Scenario: The default pagination should be 12 courses
+    Given the following "course enrolments" exist:
+      | user | course | role |
+      | student1 | C1 | student |
+      | student1 | C2 | student |
+      | student1 | C3 | student |
+      | student1 | C4 | student |
+      | student1 | C5 | student |
+      | student1 | C6 | student |
+      | student1 | C7 | student |
+      | student1 | C8 | student |
+      | student1 | C9 | student |
+      | student1 | C10 | student |
+      | student1 | C11 | student |
+      | student1 | C12 | student |
+      | student1 | C13 | student |
+    When I log in as "student1"
+    Then I should see "12" in the "[data-action='limit-toggle']" "css_element"
+    And I log out
+
+  Scenario: I should only see pagination limit options less than total number of enrolled courses
+    Given the following "course enrolments" exist:
+      | user | course | role |
+      | student1 | C1 | student |
+      | student1 | C2 | student |
+      | student1 | C3 | student |
+      | student1 | C4 | student |
+      | student1 | C5 | student |
+      | student1 | C6 | student |
+      | student1 | C7 | student |
+      | student1 | C8 | student |
+      | student1 | C9 | student |
+      | student1 | C10 | student |
+      | student1 | C11 | student |
+      | student1 | C12 | student |
+      | student1 | C13 | student |
+    And I log in as "student1"
+    When I click on "[data-action='limit-toggle']" "css_element" in the "Course overview" "block"
+    Then I should see "All" in the ".dropdown-menu.show" "css_element"
+    And I should see "12" in the ".dropdown-menu.show" "css_element"
+    And ".block_myoverview [data-control='next']" "css_element" should be visible
+    And ".block_myoverview [data-control='previous']" "css_element" should be visible
+    But I should not see "24" in the ".block_myoverview .dropdown-menu.show" "css_element"
+    And I log out
+
+  Scenario: Previous page button should be disabled when on the first page of courses
+    Given the following "course enrolments" exist:
+      | user | course | role |
+      | student1 | C1 | student |
+      | student1 | C2 | student |
+      | student1 | C3 | student |
+      | student1 | C4 | student |
+      | student1 | C5 | student |
+      | student1 | C6 | student |
+      | student1 | C7 | student |
+      | student1 | C8 | student |
+      | student1 | C9 | student |
+      | student1 | C10 | student |
+      | student1 | C11 | student |
+      | student1 | C12 | student |
+      | student1 | C13 | student |
+    When I log in as "student1"
+    Then the "class" attribute of ".block_myoverview [data-control='previous']" "css_element" should contain "disabled"
+    And I log out
+
+  Scenario: Next page button should be disabled when on the last page of courses
+    Given the following "course enrolments" exist:
+      | user | course | role |
+      | student1 | C1 | student |
+      | student1 | C2 | student |
+      | student1 | C3 | student |
+      | student1 | C4 | student |
+      | student1 | C5 | student |
+      | student1 | C6 | student |
+      | student1 | C7 | student |
+      | student1 | C8 | student |
+      | student1 | C9 | student |
+      | student1 | C10 | student |
+      | student1 | C11 | student |
+      | student1 | C12 | student |
+      | student1 | C13 | student |
+    When I log in as "student1"
+    And I click on "[data-control='next']" "css_element" in the "Course overview" "block"
+    And I wait until ".block_myoverview [data-control='next']" "css_element" exists
+    Then the "class" attribute of ".block_myoverview [data-control='next']" "css_element" should contain "disabled"
+    And I log out
+
+  Scenario: Next and previous page buttons should both be enabled when not on last or first page of courses
+    Given the following "course enrolments" exist:
+      | user | course | role |
+      | student1 | C1 | student |
+      | student1 | C2 | student |
+      | student1 | C3 | student |
+      | student1 | C4 | student |
+      | student1 | C5 | student |
+      | student1 | C6 | student |
+      | student1 | C7 | student |
+      | student1 | C8 | student |
+      | student1 | C9 | student |
+      | student1 | C10 | student |
+      | student1 | C11 | student |
+      | student1 | C12 | student |
+      | student1 | C13 | student |
+      | student1 | C14 | student |
+      | student1 | C15 | student |
+      | student1 | C16 | student |
+      | student1 | C17 | student |
+      | student1 | C18 | student |
+      | student1 | C19 | student |
+      | student1 | C20 | student |
+      | student1 | C21 | student |
+      | student1 | C22 | student |
+      | student1 | C23 | student |
+      | student1 | C24 | student |
+      | student1 | C25 | student |
+    When I log in as "student1"
+    And I click on "[data-control='next']" "css_element" in the "Course overview" "block"
+    And I wait until ".block_myoverview [data-control='next']" "css_element" exists
+    Then the "class" attribute of ".block_myoverview [data-control='next']" "css_element" should not contain "disabled"
+    And the "class" attribute of ".block_myoverview [data-control='previous']" "css_element" should not contain "disabled"
+    And I should see "Course 13" in the "Course overview" "block"
+    And I should see "Course 24" in the "Course overview" "block"
+    But I should not see "Course 12" in the "Course overview" "block"
+    And I should not see "Course 25" in the "Course overview" "block"
+    And I log out
@@ -88,14 +88,23 @@ class block_online_users extends block_base {

        $this->content->text = '<div class="info">'.$usercount.' ('.$periodminutes.')</div>';

-        // Verify if we can see the list of users, if not just print number of users
-        if (!has_capability('block/online_users:viewlist', $this->page->context)) {
+        // Verify if we can see the list of users, if not just print number of users.
+        // If the current user is not logged in OR it's a guest then don't show any users.
+        if (!has_capability('block/online_users:viewlist', $this->page->context)
+                || isguestuser() || !isloggedin()) {
            return $this->content;
        }

        $userlimit = 50; // We'll just take the most recent 50 maximum.
+        $initialcount = 0;
        if ($users = $onlineusers->get_users($userlimit)) {
+            require_once($CFG->dirroot . '/user/lib.php');
+            $initialcount = count($users);
            foreach ($users as $user) {
+                if (!user_can_view_profile($user)) {
+                    unset($users[$user->id]);
+                    continue;
+                }
                $users[$user->id]->fullname = fullname($user);
            }
        } else {
@@ -126,7 +135,8 @@ class block_online_users extends block_base {
                } else { // Not a guest user.
                    $this->content->text .= '<div class="user">';
                    $this->content->text .= '<a href="'.$CFG->wwwroot.'/user/view.php?id='.$user->id.'&amp;course='.$this->page->course->id.'" title="'.$timeago.'">';
-                    $this->content->text .= $OUTPUT->user_picture($user, array('size'=>16, 'alttext'=>false, 'link'=>false)) .$user->fullname.'</a></div>';
+                    $avataroptions = ['size' => 16, 'visibletoscreenreaders' => false, 'link' => false];
+                    $this->content->text .= $OUTPUT->user_picture($user, $avataroptions) . $user->fullname . '</a></div>';

                    if ($USER->id == $user->id) {
                        if ($CFG->block_online_users_onlinestatushiding) {
@@ -152,6 +162,14 @@ class block_online_users extends block_base {
                }
                $this->content->text .= "</li>\n";
            }
+            if ($initialcount - count($users) > 0) {
+                $this->content->text .= '<li class="listentry"><div class="otherusers">';
+                $this->content->text .= html_writer::span(
+                    get_string('otherusers', 'block_online_users', $initialcount - count($users))
+                );
+                $this->content->text .= "</div>";
+                $this->content->text .= "</li>\n";
+            }
            $this->content->text .= '</ul><div class="clearer"><!-- --></div>';
        }

@@ -86,7 +86,7 @@ class fetcher {
        }
        $params = array();

-        $userfields = \user_picture::fields('u', array('username'));
+        $userfields = \user_picture::fields('u', array('username', 'deleted'));

        // Add this to the SQL to show only group users.
        if ($currentgroup !== null) {
@@ -55,7 +55,7 @@ $capabilities = array(
        'contextlevel' => CONTEXT_BLOCK,
        'archetypes' => array(
            'user' => CAP_ALLOW,
-            'guest' => CAP_ALLOW,
+            'guest' => CAP_PREVENT,
            'student' => CAP_ALLOW,
            'teacher' => CAP_ALLOW,
            'editingteacher' => CAP_ALLOW,
@@ -23,6 +23,7 @@
 * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

+$string['otherusers'] = 'Other Users ({$a})';
 $string['onlinestatushiding_desc'] = 'If enabled, users have the option to hide their online status from other users.';
 $string['configtimetosee'] = 'Number of minutes determining the period of inactivity after which a user is no longer considered to be online.';
 $string['onlinestatushiding'] = 'Online status hiding';
@@ -7,6 +7,10 @@
    position: relative;
 }

+.block_online_users .content .list li.listentry .otherusers {
+    margin-left: 1.5rem;
+}
+
 .block_online_users .content .list li.listentry .user .userpicture {
    vertical-align: text-bottom;
 }
@@ -1,5 +1,6 @@
@block @block_online_users
 Feature: The online users block allow you to see who is currently online on dashboard
+  There should be some commonality for the users to show up
  In order to use the online users block on the dashboard
  As a user
  I can view the online users block on my dashboard
@@ -10,6 +11,14 @@ Feature: The online users block allow you to see who is currently online on dash
      | teacher1 | Teacher   | 1        | teacher1@example.com |
      | student1 | Student   | 1        | student1@example.com |
      | student2 | Student   | 2        | student2@example.com |
+    And the following "courses" exist:
+      | fullname | shortname | category |
+      | Course 1 | C1        | 0        |
+    And the following "course enrolments" exist:
+      | user | course | role           |
+      | teacher1 | C1 | editingteacher |
+      | student1 | C1 | student        |
+      | student2 | C1 | student        |

  Scenario: View the online users block on the dashboard and see myself
    Given I log in as "teacher1"
@@ -1,14 +1,22 @@
@block @block_online_users
 Feature: The online users block allow you to see who is currently online on frontpage
-  In order to enable the online users block on the front page page
+  There should be some commonality for the users to show up
+  In order to enable the online users block on the frontpage
  As an admin
-  I can add the online users block to the front page page
+  I can add the online users block to the frontpage

  Background:
    Given the following "users" exist:
      | username | firstname | lastname | email                |
      | student1 | Student   | 1        | student1@example.com |
      | student2 | Student   | 2        | student2@example.com |
+    And the following "courses" exist:
+      | fullname | shortname | category |
+      | Course 1 | C1        | 0        |
+    And the following "course enrolments" exist:
+      | user | course | role           |
+      | student1 | C1 | student        |
+      | student2 | C1 | student        |

  Scenario: View the online users block on the front page and see myself
    Given I log in as "admin"
@@ -28,7 +36,8 @@ Feature: The online users block allow you to see who is currently online on fron
    And I log out
    When I log in as "student1"
    And I am on site homepage
-    Then I should see "Admin User" in the "Online users" "block"
+    Then I should not see "Admin User" in the "Online users" "block"
+    And I should see "Other Users (1)" in the "Online users" "block"
    And I should see "Student 1" in the "Online users" "block"
    And I should see "Student 2" in the "Online users" "block"
    And I should see "3 online users" in the "Online users" "block"
@@ -45,9 +54,9 @@ Feature: The online users block allow you to see who is currently online on fron
    And I log out
    When I log in as "guest"
    And I am on site homepage
-    Then I should see "Admin User" in the "Online users" "block"
-    And I should see "Student 1" in the "Online users" "block"
-    And I should see "Student 2" in the "Online users" "block"
+    Then I should not see "Admin User" in the "Online users" "block"
+    And I should not see "Student 1" in the "Online users" "block"
+    And I should not see "Student 2" in the "Online users" "block"
    And I should see "3 online users" in the "Online users" "block"

  @javascript
@@ -69,7 +78,8 @@ Feature: The online users block allow you to see who is currently online on fron
    When I log in as "student2"
    And I am on site homepage
    Then I should see "2 online user" in the "Online users" "block"
-    And I should see "Admin" in the "Online users" "block"
+    And I should not see "Admin" in the "Online users" "block"
+    And I should see "Other Users (1)" in the "Online users" "block"
    And I should see "Student 2" in the "Online users" "block"
    And I should not see "Student 1" in the "Online users" "block"
    And I log out
@@ -83,7 +93,8 @@ Feature: The online users block allow you to see who is currently online on fron
    When I log in as "student2"
    And I am on site homepage
    Then I should see "3 online users" in the "Online users" "block"
-    And I should see "Admin" in the "Online users" "block"
+    And I should not see "Admin" in the "Online users" "block"
+    And I should see "Other Users (1)" in the "Online users" "block"
    And I should see "Student 2" in the "Online users" "block"
    And I should see "Student 1" in the "Online users" "block"

@@ -126,7 +137,8 @@ Feature: The online users block allow you to see who is currently online on fron
    And I log in as "student2"
    And I am on site homepage
    And I should see "2 online user" in the "Online users" "block"
-    And I should see "Admin" in the "Online users" "block"
+    And I should not see "Admin" in the "Online users" "block"
+    And I should see "Other Users (1)" in the "Online users" "block"
    And I should see "Student 2" in the "Online users" "block"
    And I should not see "Student 1" in the "Online users" "block"
    And I log out
@@ -135,6 +147,7 @@ Feature: The online users block allow you to see who is currently online on fron
    And I log in as "student2"
    When I am on site homepage
    Then I should see "3 online users" in the "Online users" "block"
-    And I should see "Admin" in the "Online users" "block"
+    And I should not see "Admin" in the "Online users" "block"
+    And I should see "Other Users (1)" in the "Online users" "block"
    And I should see "Student 2" in the "Online users" "block"
    And I should see "Student 1" in the "Online users" "block"
@@ -24,6 +24,6 @@

 defined('MOODLE_INTERNAL') || die();

-$plugin->version   = 2020110900;        // The current plugin version (Date: YYYYMMDDXX)
+$plugin->version   = 2020110901;        // The current plugin version (Date: YYYYMMDDXX)
 $plugin->requires  = 2020110300;        // Requires this Moodle version
 $plugin->component = 'block_online_users'; // Full name of the plugin (used for diagnostics)
@@ -46,49 +46,46 @@ Feature: View structural changes in recent activity block
      | GG3      | G2    |

  Scenario: Check that Added module information is displayed respecting view capability
-    Given I log in as "teacher1"
-    And I am on "Course 1" course homepage with editing mode on
-    And I add the "Recent activity" block
-    When I add a "Forum" to section "1" and I fill the form with:
-      | name        | ForumVisibleGroups |
-      | Description | No description     |
-      | groupmode   | Visible groups     |
-    And I add a "Forum" to section "1" and I fill the form with:
-      | name        | ForumSeparateGroups |
-      | Description | No description      |
-      | groupmode   | Separate groups     |
-    And I add a "Forum" to section "1" and I fill the form with:
-      | name        | ForumHidden    |
-      | Description | No description |
-      | Availability | 0             |
-    And I add a "Forum" to section "1" and I fill the form with:
-      | name        | ForumNoGroups  |
-      | Description | No description |
-      | groupmode   | No groups      |
-    And I add a "Forum" to section "2" and I fill the form with:
-      | name                | ForumVisibleGroupsG1 |
-      | Description         | No description       |
-      | groupmode           | Visible groups       |
-      | Grouping            | Grouping 1           |
+    Given the following "activities" exist:
+      | activity | course | section | name                  | idnumber | description    | groupmode | grouping | visible |
+      | forum    | C1     | 1       | ForumVisibleGroups    | forum1   | No description | 2         |          | 1       |
+      | forum    | C1     | 1       | ForumSeparateGroups   | forum2   | No description | 1         |          | 1       |
+      | forum    | C1     | 1       | ForumHidden           | forum3   | No description | 1         |          | 0       |
+      | forum    | C1     | 1       | ForumNoGroups         | forum4   | No description | 0         |          | 1       |
+      | forum    | C1     | 2       | ForumVisibleGroupsG1  | forum5   | No description | 2         | GG1      | 1       |
+      | forum    | C1     | 2       | ForumSeparateGroupsG1 | forum6   | No description | 1         | GG1      | 1       |
+      | forum    | C1     | 3       | ForumVisibleGroupsG2  | forum7   | No description | 2         | GG2      | 1       |
+      | forum    | C1     | 3       | ForumSeparateGroupsG2 | forum8   | No description | 1         | GG2      | 1       |
+    And I log in as "teacher1"
+
+    And I am on "Course 1" course homepage
+    And I click on "ForumVisibleGroupsG1" "link"
+    And I click on "Edit settings" "link"
+    And I set the following fields to these values:
      | Access restrictions | Grouping: Grouping 1 |
-    And I add a "Forum" to section "2" and I fill the form with:
-      | name                | ForumSeparateGroupsG1 |
-      | Description         | No description        |
-      | groupmode           | Separate groups       |
-      | Grouping            | Grouping 1            |
-      | Access restrictions | Grouping: Grouping 1  |
-    And I add a "Forum" to section "3" and I fill the form with:
-      | name                | ForumVisibleGroupsG2 |
-      | Description         | No description       |
-      | groupmode           | Visible groups       |
-      | Grouping            | Grouping 2           |
+    And I press "Save and return to course"
+
+    And I click on "ForumSeparateGroupsG1" "link"
+    And I click on "Edit settings" "link"
+    And I set the following fields to these values:
+      | Access restrictions | Grouping: Grouping 1 |
+    And I press "Save and return to course"
+
+    And I click on "ForumVisibleGroupsG2" "link"
+    And I click on "Edit settings" "link"
+    And I set the following fields to these values:
      | Access restrictions | Grouping: Grouping 2 |
-    And I add a "Forum" to section "3" and I fill the form with:
-      | name                | ForumSeparateGroupsG2 |
-      | Description         | No description        |
-      | groupmode           | Separate groups       |
-      | Grouping            | Grouping 2            |
-      | Access restrictions | Grouping: Grouping 2  |
+    And I press "Save and return to course"
+
+    And I click on "ForumSeparateGroupsG2" "link"
+    And I click on "Edit settings" "link"
+    And I set the following fields to these values:
+      | Access restrictions | Grouping: Grouping 2 |
+    And I press "Save and return to course"
+
+    And I am on "Course 1" course homepage with editing mode on
+    When I add the "Recent activity" block
+
    Then I should see "ForumVisibleGroups" in the "Recent activity" "block"
    And I should see "ForumSeparateGroups" in the "Recent activity" "block"
    And I should see "ForumNoGroups" in the "Recent activity" "block"
@@ -98,6 +95,7 @@ Feature: View structural changes in recent activity block
    And I should see "ForumVisibleGroupsG2" in the "Recent activity" "block"
    And I should see "ForumSeparateGroupsG2" in the "Recent activity" "block"
    And I log out
+
    And I log in as "student1"
    And I am on "Course 1" course homepage
    And I should see "ForumVisibleGroups" in the "Recent activity" "block"
@@ -109,6 +107,7 @@ Feature: View structural changes in recent activity block
    And I should not see "ForumVisibleGroupsG2" in the "Recent activity" "block"
    And I should not see "ForumSeparateGroupsG2" in the "Recent activity" "block"
    And I log out
+
    And I log in as "student2"
    And I am on "Course 1" course homepage
    And I should see "ForumVisibleGroups" in the "Recent activity" "block"
@@ -120,6 +119,7 @@ Feature: View structural changes in recent activity block
    And I should see "ForumVisibleGroupsG2" in the "Recent activity" "block"
    And I should see "ForumSeparateGroupsG2" in the "Recent activity" "block"
    And I log out
+
    And I log in as "student3"
    And I am on "Course 1" course homepage
    And I should see "ForumVisibleGroups" in the "Recent activity" "block"
@@ -131,6 +131,7 @@ Feature: View structural changes in recent activity block
    And I should see "ForumVisibleGroupsG2" in the "Recent activity" "block"
    And I should see "ForumSeparateGroupsG2" in the "Recent activity" "block"
    And I log out
+
    # Teachers have capability to see all groups and hidden activities
    And I log in as "assistant1"
    And I am on "Course 1" course homepage
@@ -142,15 +143,20 @@ Feature: View structural changes in recent activity block
    And I log out

  Scenario: Updates and deletes in recent activity block
+    Given the following "activity" exists:
+      | activity    | forum          |
+      | course      | C1             |
+      | idnumber    | forum1         |
+      | name        | ForumNew       |
+      | description | No description |
    When I log in as "teacher1"
    And I am on "Course 1" course homepage with editing mode on
    And I add the "Recent activity" block
-    And I add a "Forum" to section "1" and I fill the form with:
-      | name        | ForumNew       |
-      | Description | No description |
    Then I should see "Added Forum" in the "Recent activity" "block"
    And I should see "ForumNew" in the "Recent activity" "block"
    And I log out
+
+    # Update forum as a teacher after a second to ensure we have a new timestamp for recent activity.
    And I wait "1" seconds
    And I log in as "student1"
    And I am on "Course 1" course homepage
@@ -159,6 +165,7 @@ Feature: View structural changes in recent activity block
    And I log out
    # Update forum as a teacher after a second to ensure we have a new timestamp for recent activity.
    And I wait "1" seconds
+
    # Update forum as a teacher
    And I log in as "teacher1"
    And I am on "Course 1" course homepage
@@ -170,6 +177,7 @@ Feature: View structural changes in recent activity block
    And I log out
    And I wait "1" seconds
    # Student 1 already saw that forum was created, now he can see that forum was updated
+
    And I log in as "student1"
    And I am on "Course 1" course homepage
    And I should not see "Added Forum" in the "Recent activity" "block"
@@ -179,6 +187,7 @@ Feature: View structural changes in recent activity block
    And I log out
    And I wait "1" seconds
    # Student 2 has bigger interval and he can see one entry that forum was created but with the new name
+
    And I log in as "student2"
    And I am on "Course 1" course homepage
    And I should see "Added Forum" in the "Recent activity" "block"
@@ -188,6 +197,7 @@ Feature: View structural changes in recent activity block
    And I log out
    And I wait "1" seconds
    # Delete forum as a teacher
+
    And I log in as "teacher1"
    And I am on "Course 1" course homepage with editing mode on
    And I delete "ForumUpdated" activity
@@ -195,6 +205,7 @@ Feature: View structural changes in recent activity block
    And I log out
    And I wait "1" seconds
    # Students 1 and 2 see that forum was deleted
+
    And I log in as "student1"
    And I am on "Course 1" course homepage
    And I should not see "Added Forum" in the "Recent activity" "block"
@@ -205,6 +216,7 @@ Feature: View structural changes in recent activity block
    And I log out
    And I wait "1" seconds
    # Student 3 never knew that forum was created, so he does not see anything
+
    And I log in as "student3"
    And I am on "Course 1" course homepage
    And I should not see "Added Forum" in the "Recent activity" "block"
@@ -212,4 +224,3 @@ Feature: View structural changes in recent activity block
    And I should not see "Updated Forum" in the "Recent activity" "block"
    And I should not see "ForumUpdated" in the "Recent activity" "block"
    And I should not see "Deleted Forum" in the "Recent activity" "block"
-    And I log out
--- a/Show More
+++ b/Show More